revengerat | 5348e8e5955c16a1a42bc6f02f99f42c7ee156192580ddc09c60af8846412e74

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 02:47

Target

4bb7917f6adce433d84ac7ad6bdda000N.exe
Size

904KB
MD5

4bb7917f6adce433d84ac7ad6bdda000
SHA1

86acf6a2e33c9771066773f4616e3a9fd787aa9c
SHA256

5348e8e5955c16a1a42bc6f02f99f42c7ee156192580ddc09c60af8846412e74
SHA512

bd4c4683d42cefb48dc709d2f04df3807d54c9f3994ed0b783c29bc5a844a7e3ea9be16742146e2f401e7b51182ce2d78de040384c53dc1a778ab984a577f011
SSDEEP

24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5q:gh+ZkldoPK8YaKGq

Score

10^/10

Family

revengerat

Botnet

Marzo26

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Drops startup file 1 IoCs

Processes:

4bb7917f6adce433d84ac7ad6bdda000N.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url	4bb7917f6adce433d84ac7ad6bdda000N.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

4bb7917f6adce433d84ac7ad6bdda000N.exe

description pid process target process

PID 2688 set thread context of 2736 2688 4bb7917f6adce433d84ac7ad6bdda000N.exe RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 2736 RegAsm.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

4bb7917f6adce433d84ac7ad6bdda000N.exe

pid process

2688 4bb7917f6adce433d84ac7ad6bdda000N.exe
2688 4bb7917f6adce433d84ac7ad6bdda000N.exe
2688 4bb7917f6adce433d84ac7ad6bdda000N.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

4bb7917f6adce433d84ac7ad6bdda000N.exe

pid process

2688 4bb7917f6adce433d84ac7ad6bdda000N.exe
2688 4bb7917f6adce433d84ac7ad6bdda000N.exe
2688 4bb7917f6adce433d84ac7ad6bdda000N.exe

description	pid	process	target process
PID 2688 set thread context of 2736	2688	4bb7917f6adce433d84ac7ad6bdda000N.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2736	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

4bb7917f6adce433d84ac7ad6bdda000N.exe

description	pid	process	target process
PID 2688 wrote to memory of 2736	2688	4bb7917f6adce433d84ac7ad6bdda000N.exe	RegAsm.exe
PID 2688 wrote to memory of 2736	2688	4bb7917f6adce433d84ac7ad6bdda000N.exe	RegAsm.exe
PID 2688 wrote to memory of 2736	2688	4bb7917f6adce433d84ac7ad6bdda000N.exe	RegAsm.exe
PID 2688 wrote to memory of 2736	2688	4bb7917f6adce433d84ac7ad6bdda000N.exe	RegAsm.exe
PID 2688 wrote to memory of 2736	2688	4bb7917f6adce433d84ac7ad6bdda000N.exe	RegAsm.exe
PID 2688 wrote to memory of 2736	2688	4bb7917f6adce433d84ac7ad6bdda000N.exe	RegAsm.exe
PID 2688 wrote to memory of 2736	2688	4bb7917f6adce433d84ac7ad6bdda000N.exe	RegAsm.exe
PID 2688 wrote to memory of 2736	2688	4bb7917f6adce433d84ac7ad6bdda000N.exe	RegAsm.exe
PID 2688 wrote to memory of 2736	2688	4bb7917f6adce433d84ac7ad6bdda000N.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2736

memory/2688-0-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2736-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2736-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2736-2-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2736-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2736-8-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2736-9-0x0000000073A82000-0x0000000073A84000-memory.dmp

Filesize
8KB

Download
memory/2736-13-0x0000000073A82000-0x0000000073A84000-memory.dmp

Filesize
8KB

Download