revengerat | f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca

Analysis

max time kernel
143s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 05:19

Target

f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe
Size

903KB
MD5

2eb93b4c96c94421cbeabb6652d0707f
SHA1

af5e86a6dd0632ec040905c68436c05937e31e44
SHA256

f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca
SHA512

74779fb4bf883059bcf926bf151eef1d643abad1037ae8c9b3cb91b4fc43106433c35d4d6c1ce59b6c1911400f3fd305f64d4885e3e1ec090b2244171c8bfa1d
SSDEEP

24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5j:gh+ZkldoPK8YaKGj

Score

10^/10

Family

revengerat

Botnet

Marzo26

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Drops startup file 1 IoCs

Processes:

f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe

description pid process target process

PID 1260 set thread context of 2616 1260 f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 2616 RegAsm.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url	f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe

description	pid	process	target process
PID 1260 set thread context of 2616	1260	f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2616	RegAsm.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe

pid	process
1260	f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe
1260	f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe
1260	f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe

pid	process
1260	f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe
1260	f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe
1260	f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe

description	pid	process	target process
PID 1260 wrote to memory of 2616	1260	f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe	RegAsm.exe
PID 1260 wrote to memory of 2616	1260	f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe	RegAsm.exe
PID 1260 wrote to memory of 2616	1260	f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe	RegAsm.exe
PID 1260 wrote to memory of 2616	1260	f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe	RegAsm.exe
PID 1260 wrote to memory of 2616	1260	f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe	RegAsm.exe
PID 1260 wrote to memory of 2616	1260	f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe	RegAsm.exe
PID 1260 wrote to memory of 2616	1260	f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe	RegAsm.exe
PID 1260 wrote to memory of 2616	1260	f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe	RegAsm.exe
PID 1260 wrote to memory of 2616	1260	f2464c122ca518096f7eccc03e66988ef2eefbeeb03b621d81c4fea5ef55d5ca.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2616

memory/1260-6-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2616-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2616-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2616-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2616-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2616-8-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2616-9-0x0000000074682000-0x0000000074684000-memory.dmp

Filesize
8KB

Download