revengerat | 8efdb8a741b77b4661f4333f0fc0a7591a06e086a89812d2bd18660a5ceec7d4

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 18:25

Target

fda77c1c41d1112916495fb12d1509e0N.exe
Size

903KB
MD5

fda77c1c41d1112916495fb12d1509e0
SHA1

b7f8212b0f5a06fc604b0db444e7e521e028e85a
SHA256

8efdb8a741b77b4661f4333f0fc0a7591a06e086a89812d2bd18660a5ceec7d4
SHA512

984c57364e7954a4b0118c2b56f6d039e7260a437d98c3f8747e2677d90161298b15eba9a10ece434cb0fdfa2a657763e1b0c1e31c717cc430f3e946982899d9
SSDEEP

24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5p:gh+ZkldoPK8YaKGp

Score

10^/10

Family

revengerat

Botnet

Marzo26

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Drops startup file 1 IoCs

Processes:

fda77c1c41d1112916495fb12d1509e0N.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url	fda77c1c41d1112916495fb12d1509e0N.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fda77c1c41d1112916495fb12d1509e0N.exe

description pid process target process

PID 1760 set thread context of 3056 1760 fda77c1c41d1112916495fb12d1509e0N.exe RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 3056 RegAsm.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

fda77c1c41d1112916495fb12d1509e0N.exe

pid process

1760 fda77c1c41d1112916495fb12d1509e0N.exe
1760 fda77c1c41d1112916495fb12d1509e0N.exe
1760 fda77c1c41d1112916495fb12d1509e0N.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

fda77c1c41d1112916495fb12d1509e0N.exe

pid process

1760 fda77c1c41d1112916495fb12d1509e0N.exe
1760 fda77c1c41d1112916495fb12d1509e0N.exe
1760 fda77c1c41d1112916495fb12d1509e0N.exe

description	pid	process	target process
PID 1760 set thread context of 3056	1760	fda77c1c41d1112916495fb12d1509e0N.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	3056	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

fda77c1c41d1112916495fb12d1509e0N.exe

description	pid	process	target process
PID 1760 wrote to memory of 3056	1760	fda77c1c41d1112916495fb12d1509e0N.exe	RegAsm.exe
PID 1760 wrote to memory of 3056	1760	fda77c1c41d1112916495fb12d1509e0N.exe	RegAsm.exe
PID 1760 wrote to memory of 3056	1760	fda77c1c41d1112916495fb12d1509e0N.exe	RegAsm.exe
PID 1760 wrote to memory of 3056	1760	fda77c1c41d1112916495fb12d1509e0N.exe	RegAsm.exe
PID 1760 wrote to memory of 3056	1760	fda77c1c41d1112916495fb12d1509e0N.exe	RegAsm.exe
PID 1760 wrote to memory of 3056	1760	fda77c1c41d1112916495fb12d1509e0N.exe	RegAsm.exe
PID 1760 wrote to memory of 3056	1760	fda77c1c41d1112916495fb12d1509e0N.exe	RegAsm.exe
PID 1760 wrote to memory of 3056	1760	fda77c1c41d1112916495fb12d1509e0N.exe	RegAsm.exe
PID 1760 wrote to memory of 3056	1760	fda77c1c41d1112916495fb12d1509e0N.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3056

memory/1760-0-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/3056-2-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3056-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3056-8-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3056-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3056-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3056-9-0x00000000746F2000-0x00000000746F4000-memory.dmp

Filesize
8KB

Download
memory/3056-13-0x00000000746F2000-0x00000000746F4000-memory.dmp

Filesize
8KB

Download