revengerat | 0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700

Analysis

max time kernel
167s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2023, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe
Size

902KB
MD5

875a806f3b37f0268e47db10e410a761
SHA1

2408b526db41cad7cff345aa5753476147f8f0b4
SHA256

0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700
SHA512

4c057f8edcb2fc4c8b96a990cc716b38fb860fb1a49689be2af38df2d0a81e4af92387e322fe51da0f95f13f07b88f6d8d71f788e7b07b7fd5d05a26b009b831
SSDEEP

24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5H:gh+ZkldoPK8YaKGH

Score

10^/10

revengerat marzo26 stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/2432-1-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url	NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1828 set thread context of 2432	1828	NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe	93

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2432	RegAsm.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1828	NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe
1828	NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe
1828	NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe
1828	NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1828	NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe
1828	NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe
1828	NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe
1828	NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 2432	1828	NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe	93
PID 1828 wrote to memory of 2432	1828	NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe	93
PID 1828 wrote to memory of 2432	1828	NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe	93
PID 1828 wrote to memory of 2432	1828	NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe	93
PID 1828 wrote to memory of 2432	1828	NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe	93

C:\Users\Admin\AppData\Local\Temp\NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1828-0-0x00000000043D0000-0x00000000043D1000-memory.dmp

Filesize
4KB

Download
memory/2432-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2432-5-0x00000000742D0000-0x0000000074881000-memory.dmp

Filesize
5.7MB

Download
memory/2432-6-0x00000000742D0000-0x0000000074881000-memory.dmp

Filesize
5.7MB

Download
memory/2432-7-0x00000000016C0000-0x00000000016D0000-memory.dmp

Filesize
64KB

Download
memory/2432-11-0x00000000742D0000-0x0000000074881000-memory.dmp

Filesize
5.7MB

Download
memory/2432-12-0x00000000742D0000-0x0000000074881000-memory.dmp

Filesize
5.7MB

Download
memory/2432-13-0x00000000016C0000-0x00000000016D0000-memory.dmp

Filesize
64KB

Download