revengerat | fe3d1aa71f0d3acffa5c6f01be46f709d3bb5e7fc6e30d78d3910ebbf0d9764f

Resubmissions

21-07-2024 07:48

20-07-2024 23:12

max time kernel
62s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 07:48

Target

22780ee2aab9bfd063acb647b08b8080N.exe
Size

904KB
MD5

22780ee2aab9bfd063acb647b08b8080
SHA1

00cb29301e1ffb4eeab1bdf179638c8a46c5cd4d
SHA256

fe3d1aa71f0d3acffa5c6f01be46f709d3bb5e7fc6e30d78d3910ebbf0d9764f
SHA512

6250ded5f1faf1262b3f6834225b3b2b05e7bed25a8770e93b528aefa2c88ef0b49540f1589cfabb0f7b648e8fa261113dd1627d71696639f7c5f3573e780a47
SSDEEP

24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5m:gh+ZkldoPK8YaKGm

Score

10^/10

Family

revengerat

Botnet

Marzo26

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Drops startup file 1 IoCs

Processes:

22780ee2aab9bfd063acb647b08b8080N.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url	22780ee2aab9bfd063acb647b08b8080N.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

22780ee2aab9bfd063acb647b08b8080N.exe

description pid process target process

PID 984 set thread context of 1132 984 22780ee2aab9bfd063acb647b08b8080N.exe RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 1132 RegAsm.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

22780ee2aab9bfd063acb647b08b8080N.exe

pid process

984 22780ee2aab9bfd063acb647b08b8080N.exe
984 22780ee2aab9bfd063acb647b08b8080N.exe
984 22780ee2aab9bfd063acb647b08b8080N.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

22780ee2aab9bfd063acb647b08b8080N.exe

pid process

984 22780ee2aab9bfd063acb647b08b8080N.exe
984 22780ee2aab9bfd063acb647b08b8080N.exe
984 22780ee2aab9bfd063acb647b08b8080N.exe

description	pid	process	target process
PID 984 set thread context of 1132	984	22780ee2aab9bfd063acb647b08b8080N.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1132	RegAsm.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

22780ee2aab9bfd063acb647b08b8080N.exe

description	pid	process	target process
PID 984 wrote to memory of 1132	984	22780ee2aab9bfd063acb647b08b8080N.exe	RegAsm.exe
PID 984 wrote to memory of 1132	984	22780ee2aab9bfd063acb647b08b8080N.exe	RegAsm.exe
PID 984 wrote to memory of 1132	984	22780ee2aab9bfd063acb647b08b8080N.exe	RegAsm.exe
PID 984 wrote to memory of 1132	984	22780ee2aab9bfd063acb647b08b8080N.exe	RegAsm.exe
PID 984 wrote to memory of 1132	984	22780ee2aab9bfd063acb647b08b8080N.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1132

memory/984-0-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Filesize
4KB

Download
memory/1132-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1132-5-0x0000000073C62000-0x0000000073C63000-memory.dmp

Filesize
4KB

Download
memory/1132-6-0x0000000073C60000-0x0000000074211000-memory.dmp

Filesize
5.7MB

Download
memory/1132-7-0x0000000073C60000-0x0000000074211000-memory.dmp

Filesize
5.7MB

Download
memory/1132-11-0x0000000073C62000-0x0000000073C63000-memory.dmp

Filesize
4KB

Download
memory/1132-12-0x0000000073C60000-0x0000000074211000-memory.dmp

Filesize
5.7MB

Download