revengerat | 9022b5d4a99580efe76326add13f8216629ce60f236b0cc8353114c242a5eaaa

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2024 02:08

Target

6176f8bb39876ac1546cdbbe83007b3a.exe
Size

39KB
MD5

6176f8bb39876ac1546cdbbe83007b3a
SHA1

54c05ebf22aaee78a1b9c839c9490003a527c048
SHA256

9022b5d4a99580efe76326add13f8216629ce60f236b0cc8353114c242a5eaaa
SHA512

b341a47ca86aafbcea61ecc3cefcce8bc6121bd706218a74441a59a6d464450ea0943bdc8efa29d65e31ca8384156608daf7e622d727c454ea06cbd9c4fcee74
SSDEEP

768:BBVMFf2872zFE4cQFv+mHWEp8qhsxEgGEvkOxAEG3ltQM0Jo4yDL85LnUC:nVMFfR74/FKEKqhUE+vk0AjQvir8NX

Score

10^/10

Family

revengerat

Botnet

Guest

127.0.0.1:3333

Mutex

RV_MUTEX-DxjEexVoqqNL

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/2044-2-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

6176f8bb39876ac1546cdbbe83007b3a.exe

description pid process target process

PID 3388 set thread context of 2044 3388 6176f8bb39876ac1546cdbbe83007b3a.exe MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 2044 MSBuild.exe

description	pid	process	target process
PID 3388 set thread context of 2044	3388	6176f8bb39876ac1546cdbbe83007b3a.exe	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	2044	MSBuild.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

6176f8bb39876ac1546cdbbe83007b3a.exe

description	pid	process	target process
PID 3388 wrote to memory of 2044	3388	6176f8bb39876ac1546cdbbe83007b3a.exe	MSBuild.exe
PID 3388 wrote to memory of 2044	3388	6176f8bb39876ac1546cdbbe83007b3a.exe	MSBuild.exe
PID 3388 wrote to memory of 2044	3388	6176f8bb39876ac1546cdbbe83007b3a.exe	MSBuild.exe
PID 3388 wrote to memory of 2044	3388	6176f8bb39876ac1546cdbbe83007b3a.exe	MSBuild.exe
PID 3388 wrote to memory of 2044	3388	6176f8bb39876ac1546cdbbe83007b3a.exe	MSBuild.exe
PID 3388 wrote to memory of 2044	3388	6176f8bb39876ac1546cdbbe83007b3a.exe	MSBuild.exe
PID 3388 wrote to memory of 2044	3388	6176f8bb39876ac1546cdbbe83007b3a.exe	MSBuild.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2044

memory/2044-2-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2044-5-0x0000000074C50000-0x0000000075201000-memory.dmp

Filesize
5.7MB

Download
memory/2044-6-0x0000000074C50000-0x0000000075201000-memory.dmp

Filesize
5.7MB

Download
memory/2044-7-0x0000000000E20000-0x0000000000E30000-memory.dmp

Filesize
64KB

Download
memory/2044-9-0x0000000074C50000-0x0000000075201000-memory.dmp

Filesize
5.7MB

Download
memory/2044-10-0x0000000000E20000-0x0000000000E30000-memory.dmp

Filesize
64KB

Download
memory/3388-0-0x0000022C56E90000-0x0000022C56EA0000-memory.dmp

Filesize
64KB

Download
memory/3388-1-0x0000022C589F0000-0x0000022C589FA000-memory.dmp

Filesize
40KB

Download
memory/3388-3-0x00007FFD5B8F0000-0x00007FFD5C3B1000-memory.dmp

Filesize
10.8MB

Download
memory/3388-8-0x00007FFD5B8F0000-0x00007FFD5C3B1000-memory.dmp

Filesize
10.8MB

Download