revengerat | 668b9ede64eeab5a2c9015f36b8c6956fa53635ff9ca9cfefb294fc71942f613

Analysis

max time kernel
120s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 09:26

Target

998623a5dbfd495eb486914e66fe4070N.exe
Size

904KB
MD5

998623a5dbfd495eb486914e66fe4070
SHA1

6db112bb8c9d617b6dbd23ccfd411f9204e90af3
SHA256

668b9ede64eeab5a2c9015f36b8c6956fa53635ff9ca9cfefb294fc71942f613
SHA512

8ceb531914b054a7eee315d8cae9e3ecc08ec400ff7834a294268f28f0c3519c079e957dc98f43c2b3d7518dcd42d8e88091062c20512313de27caeea7c5c415
SSDEEP

24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa58:gh+ZkldoPK8YaKG8

Score

10^/10

Family

revengerat

Botnet

Marzo26

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Drops startup file 1 IoCs

Processes:

998623a5dbfd495eb486914e66fe4070N.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url	998623a5dbfd495eb486914e66fe4070N.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

998623a5dbfd495eb486914e66fe4070N.exe

description pid process target process

PID 3568 set thread context of 3204 3568 998623a5dbfd495eb486914e66fe4070N.exe RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 3204 RegAsm.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

998623a5dbfd495eb486914e66fe4070N.exe

pid process

3568 998623a5dbfd495eb486914e66fe4070N.exe
3568 998623a5dbfd495eb486914e66fe4070N.exe
3568 998623a5dbfd495eb486914e66fe4070N.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

998623a5dbfd495eb486914e66fe4070N.exe

pid process

3568 998623a5dbfd495eb486914e66fe4070N.exe
3568 998623a5dbfd495eb486914e66fe4070N.exe
3568 998623a5dbfd495eb486914e66fe4070N.exe

description	pid	process	target process
PID 3568 set thread context of 3204	3568	998623a5dbfd495eb486914e66fe4070N.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	3204	RegAsm.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

998623a5dbfd495eb486914e66fe4070N.exe

description	pid	process	target process
PID 3568 wrote to memory of 3204	3568	998623a5dbfd495eb486914e66fe4070N.exe	RegAsm.exe
PID 3568 wrote to memory of 3204	3568	998623a5dbfd495eb486914e66fe4070N.exe	RegAsm.exe
PID 3568 wrote to memory of 3204	3568	998623a5dbfd495eb486914e66fe4070N.exe	RegAsm.exe
PID 3568 wrote to memory of 3204	3568	998623a5dbfd495eb486914e66fe4070N.exe	RegAsm.exe
PID 3568 wrote to memory of 3204	3568	998623a5dbfd495eb486914e66fe4070N.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3204

memory/3204-1-0x00000000001A0000-0x00000000001A8000-memory.dmp

Filesize
32KB

Download
memory/3204-5-0x00000000738E2000-0x00000000738E3000-memory.dmp

Filesize
4KB

Download
memory/3204-6-0x00000000738E0000-0x0000000073E91000-memory.dmp

Filesize
5.7MB

Download
memory/3204-7-0x00000000738E0000-0x0000000073E91000-memory.dmp

Filesize
5.7MB

Download
memory/3204-11-0x00000000738E2000-0x00000000738E3000-memory.dmp

Filesize
4KB

Download
memory/3204-12-0x00000000738E0000-0x0000000073E91000-memory.dmp

Filesize
5.7MB

Download
memory/3568-0-0x0000000003650000-0x0000000003651000-memory.dmp

Filesize
4KB

Download