revengerat | 91be5dd3d0e017cce8252c160645421220e85b6b03ae60e4627860833f826ed6

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 11:17

Target

b5d9aa761f395708b95d3f9f5b5a1bd0N.exe
Size

903KB
MD5

b5d9aa761f395708b95d3f9f5b5a1bd0
SHA1

b251bcf2111fb5ba09acb49801ef585172cc49ea
SHA256

91be5dd3d0e017cce8252c160645421220e85b6b03ae60e4627860833f826ed6
SHA512

ac9a27dd6354a055b4e4c1d621c70e18dab421091c7b7efa0956a1fab163fa2d6d339ce48b211c21d8e2246cdbabeef032a9dd56ac11e2b49ef3662f2b89f034
SSDEEP

24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5Y:gh+ZkldoPK8YaKGY

Score

10^/10

Family

revengerat

Botnet

Marzo26

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Drops startup file 1 IoCs

Processes:

b5d9aa761f395708b95d3f9f5b5a1bd0N.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url	b5d9aa761f395708b95d3f9f5b5a1bd0N.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b5d9aa761f395708b95d3f9f5b5a1bd0N.exe

description pid process target process

PID 1848 set thread context of 2296 1848 b5d9aa761f395708b95d3f9f5b5a1bd0N.exe RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 2296 RegAsm.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

b5d9aa761f395708b95d3f9f5b5a1bd0N.exe

pid process

1848 b5d9aa761f395708b95d3f9f5b5a1bd0N.exe
1848 b5d9aa761f395708b95d3f9f5b5a1bd0N.exe
1848 b5d9aa761f395708b95d3f9f5b5a1bd0N.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

b5d9aa761f395708b95d3f9f5b5a1bd0N.exe

pid process

1848 b5d9aa761f395708b95d3f9f5b5a1bd0N.exe
1848 b5d9aa761f395708b95d3f9f5b5a1bd0N.exe
1848 b5d9aa761f395708b95d3f9f5b5a1bd0N.exe

description	pid	process	target process
PID 1848 set thread context of 2296	1848	b5d9aa761f395708b95d3f9f5b5a1bd0N.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2296	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b5d9aa761f395708b95d3f9f5b5a1bd0N.exe

description	pid	process	target process
PID 1848 wrote to memory of 2296	1848	b5d9aa761f395708b95d3f9f5b5a1bd0N.exe	RegAsm.exe
PID 1848 wrote to memory of 2296	1848	b5d9aa761f395708b95d3f9f5b5a1bd0N.exe	RegAsm.exe
PID 1848 wrote to memory of 2296	1848	b5d9aa761f395708b95d3f9f5b5a1bd0N.exe	RegAsm.exe
PID 1848 wrote to memory of 2296	1848	b5d9aa761f395708b95d3f9f5b5a1bd0N.exe	RegAsm.exe
PID 1848 wrote to memory of 2296	1848	b5d9aa761f395708b95d3f9f5b5a1bd0N.exe	RegAsm.exe
PID 1848 wrote to memory of 2296	1848	b5d9aa761f395708b95d3f9f5b5a1bd0N.exe	RegAsm.exe
PID 1848 wrote to memory of 2296	1848	b5d9aa761f395708b95d3f9f5b5a1bd0N.exe	RegAsm.exe
PID 1848 wrote to memory of 2296	1848	b5d9aa761f395708b95d3f9f5b5a1bd0N.exe	RegAsm.exe
PID 1848 wrote to memory of 2296	1848	b5d9aa761f395708b95d3f9f5b5a1bd0N.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2296

memory/1848-0-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2296-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2296-2-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2296-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2296-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2296-8-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2296-9-0x0000000073A32000-0x0000000073A34000-memory.dmp

Filesize
8KB

Download