revengerat | fe3d1aa71f0d3acffa5c6f01be46f709d3bb5e7fc6e30d78d3910ebbf0d9764f

Resubmissions

21-07-2024 07:48

20-07-2024 23:12

max time kernel
144s
max time network
151s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 07:48

Target

22780ee2aab9bfd063acb647b08b8080N.exe
Size

904KB
MD5

22780ee2aab9bfd063acb647b08b8080
SHA1

00cb29301e1ffb4eeab1bdf179638c8a46c5cd4d
SHA256

fe3d1aa71f0d3acffa5c6f01be46f709d3bb5e7fc6e30d78d3910ebbf0d9764f
SHA512

6250ded5f1faf1262b3f6834225b3b2b05e7bed25a8770e93b528aefa2c88ef0b49540f1589cfabb0f7b648e8fa261113dd1627d71696639f7c5f3573e780a47
SSDEEP

24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5m:gh+ZkldoPK8YaKGm

Score

10^/10

Family

revengerat

Botnet

Marzo26

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Drops startup file 1 IoCs

Processes:

22780ee2aab9bfd063acb647b08b8080N.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url	22780ee2aab9bfd063acb647b08b8080N.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

22780ee2aab9bfd063acb647b08b8080N.exe

description pid process target process

PID 1848 set thread context of 2156 1848 22780ee2aab9bfd063acb647b08b8080N.exe RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 2156 RegAsm.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

22780ee2aab9bfd063acb647b08b8080N.exe

pid process

1848 22780ee2aab9bfd063acb647b08b8080N.exe
1848 22780ee2aab9bfd063acb647b08b8080N.exe
1848 22780ee2aab9bfd063acb647b08b8080N.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

22780ee2aab9bfd063acb647b08b8080N.exe

pid process

1848 22780ee2aab9bfd063acb647b08b8080N.exe
1848 22780ee2aab9bfd063acb647b08b8080N.exe
1848 22780ee2aab9bfd063acb647b08b8080N.exe

description	pid	process	target process
PID 1848 set thread context of 2156	1848	22780ee2aab9bfd063acb647b08b8080N.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2156	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

22780ee2aab9bfd063acb647b08b8080N.exe

description	pid	process	target process
PID 1848 wrote to memory of 2156	1848	22780ee2aab9bfd063acb647b08b8080N.exe	RegAsm.exe
PID 1848 wrote to memory of 2156	1848	22780ee2aab9bfd063acb647b08b8080N.exe	RegAsm.exe
PID 1848 wrote to memory of 2156	1848	22780ee2aab9bfd063acb647b08b8080N.exe	RegAsm.exe
PID 1848 wrote to memory of 2156	1848	22780ee2aab9bfd063acb647b08b8080N.exe	RegAsm.exe
PID 1848 wrote to memory of 2156	1848	22780ee2aab9bfd063acb647b08b8080N.exe	RegAsm.exe
PID 1848 wrote to memory of 2156	1848	22780ee2aab9bfd063acb647b08b8080N.exe	RegAsm.exe
PID 1848 wrote to memory of 2156	1848	22780ee2aab9bfd063acb647b08b8080N.exe	RegAsm.exe
PID 1848 wrote to memory of 2156	1848	22780ee2aab9bfd063acb647b08b8080N.exe	RegAsm.exe
PID 1848 wrote to memory of 2156	1848	22780ee2aab9bfd063acb647b08b8080N.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2156

memory/1848-0-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2156-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2156-8-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2156-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2156-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2156-2-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2156-9-0x0000000073A32000-0x0000000073A34000-memory.dmp

Filesize
8KB

Download
memory/2156-13-0x0000000073A32000-0x0000000073A34000-memory.dmp

Filesize
8KB

Download