revengerat | 7f1f34b9ff27c703a186f84488ba4dc80d9179d198244e8cdc6f8a6845e8bb26

Analysis

max time kernel
299s
max time network
179s
platform
windows10-1703_x64
resource
win10-20230621-en
resource tags

arch:x64arch:x86image:win10-20230621-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2023 17:24

Target

Test.exe
Size

16KB
MD5

882177e58293fb9367a89a760fb78dca
SHA1

0af6ee56e715dbd15ccee8710ad67a4e9842896c
SHA256

7f1f34b9ff27c703a186f84488ba4dc80d9179d198244e8cdc6f8a6845e8bb26
SHA512

ff9bea08d1af9efc8c1f8395bc2b6edd708486dc380beb3a52ea1efed0ce87df6820676141afe3bc6a015ce9c23d44e74266a00602573221fa3f30ddb8bdb440
SSDEEP

384:V/5gk7lVzF3smf9oDPlMNcLlb5sVKhy75Ct:V/5gk7lVZjclMNEYo

Score

10^/10

Family

revengerat

Botnet

Guest

127.0.0.1:333

Mutex

RV_MUTEX

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/4280-117-0x0000000000570000-0x0000000000578000-memory.dmp	revengerat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Test.exe

description pid process

Token: SeDebugPrivilege 4280 Test.exe

description	pid	process
Token: SeDebugPrivilege	4280	Test.exe

C:\Users\Admin\AppData\Local\Temp\Test.exe
"C:\Users\Admin\AppData\Local\Temp\Test.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4280

memory/4280-117-0x0000000000570000-0x0000000000578000-memory.dmp

Filesize
32KB

Download
memory/4280-118-0x000000001B850000-0x000000001BD1E000-memory.dmp

Filesize
4.8MB

Download
memory/4280-119-0x000000001BDD0000-0x000000001BE76000-memory.dmp

Filesize
664KB

Download
memory/4280-120-0x0000000002750000-0x0000000002760000-memory.dmp

Filesize
64KB

Download
memory/4280-121-0x000000001BF40000-0x000000001BFA2000-memory.dmp

Filesize
392KB

Download
memory/4280-122-0x0000000002750000-0x0000000002760000-memory.dmp

Filesize
64KB

Download