revengerat | 7f1f34b9ff27c703a186f84488ba4dc80d9179d198244e8cdc6f8a6845e8bb26 | Triage

Analysis

max time kernel
149s
max time network
30s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
01-07-2023 07:36

Sharing

Report Analysis Logs

General

Target

Testexe.exe
Size

16KB
MD5

882177e58293fb9367a89a760fb78dca
SHA1

0af6ee56e715dbd15ccee8710ad67a4e9842896c
SHA256

7f1f34b9ff27c703a186f84488ba4dc80d9179d198244e8cdc6f8a6845e8bb26
SHA512

ff9bea08d1af9efc8c1f8395bc2b6edd708486dc380beb3a52ea1efed0ce87df6820676141afe3bc6a015ce9c23d44e74266a00602573221fa3f30ddb8bdb440
SSDEEP

384:V/5gk7lVzF3smf9oDPlMNcLlb5sVKhy75Ct:V/5gk7lVZjclMNEYo

Score

10^/10

revengerat guest stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

127.0.0.1:333

Mutex

RV_MUTEX

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1256-54-0x00000000013A0000-0x00000000013A8000-memory.dmp	revengerat
behavioral1/memory/1256-55-0x00000000008D0000-0x0000000000950000-memory.dmp	revengerat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Testexe.exe

description pid process

Token: SeDebugPrivilege 1256 Testexe.exe

C:\Users\Admin\AppData\Local\Temp\Testexe.exe
"C:\Users\Admin\AppData\Local\Temp\Testexe.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-54-0x00000000013A0000-0x00000000013A8000-memory.dmp

Filesize
32KB

Download
memory/1256-55-0x00000000008D0000-0x0000000000950000-memory.dmp

Filesize
512KB

Download
memory/1256-56-0x00000000008D0000-0x0000000000950000-memory.dmp

Filesize
512KB

Download