revengerat | 29c6eeefb28778392662fb00c32f60b865a96b520f11c82d86b2c97d29b75f1b

Analysis

max time kernel
95s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2024 10:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

558s2.exe
Size

16KB
MD5

f3b5ca2db7b79a0bb68f19b1e2f57890
SHA1

c98a6aad076c016bdcdf312b00fa7407b7eb3643
SHA256

29c6eeefb28778392662fb00c32f60b865a96b520f11c82d86b2c97d29b75f1b
SHA512

f46db5cc9366d913397ce73ecd908840471a6911784070bcb446bfe8d3152e6f21d30fabc96029e8a38533ab97cb378a4ce9ac2dee63e315664cf64c3436446d
SSDEEP

384:deIl8I7mYfcZExHtW3lFDOx3M/IfoNAlp6RpQ:deC8sfEEttWVQxoI1C7Q

Score

10^/10

revengerat nyancatrevenge trojan

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

102.165.46.145:333

Mutex

pHXJvbCGPPiC

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	558s2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	558s2.exe

C:\Users\Admin\AppData\Local\Temp\558s2.exe
"C:\Users\Admin\AppData\Local\Temp\558s2.exe"
1⤵
- Checks processor information in registry
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-0-0x00007FFB68253000-0x00007FFB68255000-memory.dmp

Filesize
8KB

Download
memory/1628-1-0x0000000000740000-0x000000000074A000-memory.dmp

Filesize
40KB

Download
memory/1628-2-0x00007FFB68250000-0x00007FFB68D11000-memory.dmp

Filesize
10.8MB

Download
memory/1628-3-0x00007FFB68250000-0x00007FFB68D11000-memory.dmp

Filesize
10.8MB

Download