revengerat | 9b71cc8cba058ca46d19910c8ab923f13e3bab97be36f22bdc8b7a54e9b0bc6b

Analysis

max time kernel
147s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 01:53

Target

50c9178111217d5dd2be6e1f4ed0da30_NeikiAnalytics.exe
Size

399KB
MD5

50c9178111217d5dd2be6e1f4ed0da30
SHA1

44b0437d2ab93187cfebfe957dcbe80642070f65
SHA256

9b71cc8cba058ca46d19910c8ab923f13e3bab97be36f22bdc8b7a54e9b0bc6b
SHA512

5382935d54e2dbdc67f598914f96715584e91dbf63cb82be894e34900bcf1db130a06ac05b30fb217b462642a0b275f8d1e9761bcf25b9fdee450a7d92b1e56d
SSDEEP

6144:zsf2hltcA3MAIxsI2uovynPT4tVoDhDsiFXU3TFSGLLZOb7GF:zsf2hldla2nynCSDhPFXU3TFSGH0b7

Score

10^/10

Family

revengerat

Botnet

Guest

127.0.0.1:333

Mutex

RV_MUTEX

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1712 set thread context of 2472	1712	50c9178111217d5dd2be6e1f4ed0da30_NeikiAnalytics.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2472	50c9178111217d5dd2be6e1f4ed0da30_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2472	1712	50c9178111217d5dd2be6e1f4ed0da30_NeikiAnalytics.exe	28
PID 1712 wrote to memory of 2472	1712	50c9178111217d5dd2be6e1f4ed0da30_NeikiAnalytics.exe	28
PID 1712 wrote to memory of 2472	1712	50c9178111217d5dd2be6e1f4ed0da30_NeikiAnalytics.exe	28
PID 1712 wrote to memory of 2472	1712	50c9178111217d5dd2be6e1f4ed0da30_NeikiAnalytics.exe	28
PID 1712 wrote to memory of 2472	1712	50c9178111217d5dd2be6e1f4ed0da30_NeikiAnalytics.exe	28
PID 1712 wrote to memory of 2472	1712	50c9178111217d5dd2be6e1f4ed0da30_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\50c9178111217d5dd2be6e1f4ed0da30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\50c9178111217d5dd2be6e1f4ed0da30_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\50c9178111217d5dd2be6e1f4ed0da30_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\50c9178111217d5dd2be6e1f4ed0da30_NeikiAnalytics.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2472

memory/1712-22-0x0000000073F00000-0x00000000745EE000-memory.dmp

Filesize
6.9MB

Download
memory/1712-1-0x0000000000080000-0x00000000000EA000-memory.dmp

Filesize
424KB

Download
memory/1712-2-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1712-3-0x0000000073F00000-0x00000000745EE000-memory.dmp

Filesize
6.9MB

Download
memory/1712-4-0x00000000003D0000-0x00000000003DA000-memory.dmp

Filesize
40KB

Download
memory/1712-21-0x0000000073F00000-0x00000000745EE000-memory.dmp

Filesize
6.9MB

Download
memory/1712-0-0x0000000073F0E000-0x0000000073F0F000-memory.dmp

Filesize
4KB

Download
memory/2472-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2472-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2472-24-0x0000000073F00000-0x00000000745EE000-memory.dmp

Filesize
6.9MB

Download
memory/2472-23-0x0000000073F00000-0x00000000745EE000-memory.dmp

Filesize
6.9MB

Download
memory/2472-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2472-25-0x0000000073F00000-0x00000000745EE000-memory.dmp

Filesize
6.9MB

Download