revengerat | ba441bdd43380f2210ef9b4ec0033d803c2bc456142a775aeab4282c0f4e84f3

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 17:07

Target

f09e136f8214caf2c9c0441d5d91b3f0N.exe
Size

952KB
MD5

f09e136f8214caf2c9c0441d5d91b3f0
SHA1

c0f58a4d0efd7e5b468f1f02fa242d876fdb3859
SHA256

ba441bdd43380f2210ef9b4ec0033d803c2bc456142a775aeab4282c0f4e84f3
SHA512

8dd1a074926729c012965a8f9dc1056f5ea05c23bd5a9d927e989525dac35d2c04a8820dac771f4a72fa61d0257a06140d4099726da8b83fa6267ce353363548
SSDEEP

24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5M:Rh+ZkldDPK8YaKjM

Score

10^/10

Family

revengerat

Botnet

Marzo26

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Drops startup file 1 IoCs

Processes:

f09e136f8214caf2c9c0441d5d91b3f0N.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url	f09e136f8214caf2c9c0441d5d91b3f0N.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/1956-0-0x00000000005E0000-0x00000000006D3000-memory.dmp	autoit_exe
behavioral2/memory/1956-12-0x00000000005E0000-0x00000000006D3000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f09e136f8214caf2c9c0441d5d91b3f0N.exe

description pid process target process

PID 1956 set thread context of 940 1956 f09e136f8214caf2c9c0441d5d91b3f0N.exe RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 940 RegAsm.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

f09e136f8214caf2c9c0441d5d91b3f0N.exe

pid process

1956 f09e136f8214caf2c9c0441d5d91b3f0N.exe
1956 f09e136f8214caf2c9c0441d5d91b3f0N.exe
1956 f09e136f8214caf2c9c0441d5d91b3f0N.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

f09e136f8214caf2c9c0441d5d91b3f0N.exe

pid process

1956 f09e136f8214caf2c9c0441d5d91b3f0N.exe
1956 f09e136f8214caf2c9c0441d5d91b3f0N.exe
1956 f09e136f8214caf2c9c0441d5d91b3f0N.exe

description	pid	process	target process
PID 1956 set thread context of 940	1956	f09e136f8214caf2c9c0441d5d91b3f0N.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	940	RegAsm.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f09e136f8214caf2c9c0441d5d91b3f0N.exe

description	pid	process	target process
PID 1956 wrote to memory of 940	1956	f09e136f8214caf2c9c0441d5d91b3f0N.exe	RegAsm.exe
PID 1956 wrote to memory of 940	1956	f09e136f8214caf2c9c0441d5d91b3f0N.exe	RegAsm.exe
PID 1956 wrote to memory of 940	1956	f09e136f8214caf2c9c0441d5d91b3f0N.exe	RegAsm.exe
PID 1956 wrote to memory of 940	1956	f09e136f8214caf2c9c0441d5d91b3f0N.exe	RegAsm.exe
PID 1956 wrote to memory of 940	1956	f09e136f8214caf2c9c0441d5d91b3f0N.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:940

memory/940-2-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/940-6-0x0000000074082000-0x0000000074083000-memory.dmp

Filesize
4KB

Download
memory/940-7-0x0000000074080000-0x0000000074631000-memory.dmp

Filesize
5.7MB

Download
memory/940-8-0x0000000074080000-0x0000000074631000-memory.dmp

Filesize
5.7MB

Download
memory/940-13-0x0000000074082000-0x0000000074083000-memory.dmp

Filesize
4KB

Download
memory/940-14-0x0000000074080000-0x0000000074631000-memory.dmp

Filesize
5.7MB

Download
memory/1956-0-0x00000000005E0000-0x00000000006D3000-memory.dmp

Filesize
972KB

Download
memory/1956-1-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/1956-12-0x00000000005E0000-0x00000000006D3000-memory.dmp

Filesize
972KB

Download