revengerat | 4eeb5d8830e378c5c351d8ea1f8b370364e6ab530573e1f609d8d459e3f23b1a

Analysis

max time kernel
124s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lime-Worm-0.5.8D\database32.exe
Size

2.8MB
MD5

7028559abf0ccebf9692eb24651b4be1
SHA1

474e96eb203f4978c9c6e7568f4b7a9b20c329af
SHA256

b437592443e6c798ac25566400e1a1b4f29ef76a63bc5cd112316f5f4f34e45e
SHA512

3d0d22d68dda3fb8b27a31216c9a31387e8937645cd0bce7ca5e89f91b4f3addc6d05244cd9617acbecd26547adb563f7e40e516d398d4c741eefb295ff10f3e
SSDEEP

24576:1dTuyaUzkI/oMi5QNCRzJ4ZBoPUDmJbedDxCPEicdjFhu8bU:1dTuyaU/or+AkyNyXicdjFhuC

Score

10^/10

revengerat stealer trojan

Malware Config

Extracted

Family

revengerat

Mutex

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
RevengeRat Executable 1 IoCs
stealer

Processes:

resource yara_rule

behavioral20/memory/2668-18-0x000000001C510000-0x000000001C518000-memory.dmp revengerat

resource	yara_rule
behavioral20/memory/2668-18-0x000000001C510000-0x000000001C518000-memory.dmp	revengerat

Modifies registry class 3 IoCs

Processes:

database32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\CID	database32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\CID\{44007200-6700-4A00-6700-380030006E00}\1 = "F/9HNugc6bhOVNMuy4lOyOFp1U+GChcZ29hrtHkvLyRwGVaI4OrMcwVauwtke5vvUBMN+t1K8DnV6HSqidQZnShV95XKTDcp/LPapD6vewn5INfB3g77StIS75DhgkT7D+RuA2I1wGe7E3Lzb+F8tRGl2sTLwO4P50dSWqLuNUsOk3f0bNqFlmLOUAdD6IqITkLDFurHZdsENDIaTUJ/PNJXGJ2itiw8sIMPSzKxF/4LZRI+/NWTiw2HL+XdAPErcgS1twEP3hwR915sbBvILe1/oEGX7WxG1QchCU90L57jiJRXPolV6sA/hys1jZHz0vgiAYHGeVngQHjUmfmM6Te1NHvWseEBsGmYtYw1rFaVGRhxX+7YaN1POXqzIK3FZPzloDmy3rW169uZnrFA+sb64yVbH0RdQOFX/E7nicaRzUMm8CkK+I4AoWN+DTzgV+ar+bY5YAfW+8rrr9gZRg=="	database32.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\CID\{44007200-6700-4A00-6700-380030006E00}	database32.exe

NTFS ADS 1 IoCs

Processes:

database32.exe

description ioc process

File created C:\Users\Admin\AppData\Local\Temp\Lime-Worm-0.5.8D:{44007200-6700-4A00-6700-380030006E00} database32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

database32.exe

description pid process

Token: SeDebugPrivilege 2668 database32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

database32.exe

pid process

2668 database32.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

database32.exe

pid process

2668 database32.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\Lime-Worm-0.5.8D:{44007200-6700-4A00-6700-380030006E00}	database32.exe

description	pid	process
Token: SeDebugPrivilege	2668	database32.exe

pid	process
2668	database32.exe

pid	process
2668	database32.exe

C:\Users\Admin\AppData\Local\Temp\Lime-Worm-0.5.8D\database32.exe
"C:\Users\Admin\AppData\Local\Temp\Lime-Worm-0.5.8D\database32.exe"
1⤵
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2668-0-0x00007FF8DB135000-0x00007FF8DB136000-memory.dmp

Filesize
4KB

Download
memory/2668-1-0x000000001BA90000-0x000000001BB36000-memory.dmp

Filesize
664KB

Download
memory/2668-2-0x00007FF8DAE80000-0x00007FF8DB821000-memory.dmp

Filesize
9.6MB

Download
memory/2668-3-0x00007FF8DAE80000-0x00007FF8DB821000-memory.dmp

Filesize
9.6MB

Download
memory/2668-4-0x000000001C010000-0x000000001C4DE000-memory.dmp

Filesize
4.8MB

Download
memory/2668-5-0x000000001C5E0000-0x000000001C67C000-memory.dmp

Filesize
624KB

Download
memory/2668-6-0x0000000001490000-0x0000000001498000-memory.dmp

Filesize
32KB

Download
memory/2668-7-0x000000001C740000-0x000000001C78C000-memory.dmp

Filesize
304KB

Download
memory/2668-8-0x00007FF8DAE80000-0x00007FF8DB821000-memory.dmp

Filesize
9.6MB

Download
memory/2668-9-0x00007FF8DAE80000-0x00007FF8DB821000-memory.dmp

Filesize
9.6MB

Download
memory/2668-10-0x00007FF8DAE80000-0x00007FF8DB821000-memory.dmp

Filesize
9.6MB

Download
memory/2668-11-0x00000000215C0000-0x0000000021618000-memory.dmp

Filesize
352KB

Download
memory/2668-12-0x00007FF8DAE80000-0x00007FF8DB821000-memory.dmp

Filesize
9.6MB

Download
memory/2668-13-0x0000000021B80000-0x0000000021BE2000-memory.dmp

Filesize
392KB

Download
memory/2668-18-0x000000001C510000-0x000000001C518000-memory.dmp

Filesize
32KB

Download
memory/2668-17-0x0000000020080000-0x0000000020150000-memory.dmp

Filesize
832KB

Download
memory/2668-19-0x00007FF8DAE80000-0x00007FF8DB821000-memory.dmp

Filesize
9.6MB

Download
memory/2668-21-0x00007FF8DB135000-0x00007FF8DB136000-memory.dmp

Filesize
4KB

Download
memory/2668-22-0x00007FF8DAE80000-0x00007FF8DB821000-memory.dmp

Filesize
9.6MB

Download