revengerat | 04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 18:22

Target

04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe
Size

903KB
MD5

cc8819fe9ab8c017c0fb615821ea6c69
SHA1

4b9d635e0cc1286a54611301115ff88eebc52ec0
SHA256

04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c
SHA512

372ff8a633068d858b4e1ee1b25071a82c6867f7e1cd6b09137fea3f9d28e5317602b2724c456f79c5e8e0d13b5ef05a9d70392f7ecffc76121dc0270fd2940d
SSDEEP

24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5l:gh+ZkldoPK8YaKGl

Score

10^/10

Family

revengerat

Botnet

Marzo26

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Drops startup file 1 IoCs

Processes:

04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url 04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe

description pid process target process

PID 1848 set thread context of 1856 1848 04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 1856 RegAsm.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url	04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe

description	pid	process	target process
PID 1848 set thread context of 1856	1848	04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1856	RegAsm.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe

pid	process
1848	04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe
1848	04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe
1848	04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe

pid	process
1848	04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe
1848	04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe
1848	04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe

description	pid	process	target process
PID 1848 wrote to memory of 1856	1848	04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe	RegAsm.exe
PID 1848 wrote to memory of 1856	1848	04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe	RegAsm.exe
PID 1848 wrote to memory of 1856	1848	04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe	RegAsm.exe
PID 1848 wrote to memory of 1856	1848	04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe	RegAsm.exe
PID 1848 wrote to memory of 1856	1848	04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe	RegAsm.exe
PID 1848 wrote to memory of 1856	1848	04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe	RegAsm.exe
PID 1848 wrote to memory of 1856	1848	04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe	RegAsm.exe
PID 1848 wrote to memory of 1856	1848	04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe	RegAsm.exe
PID 1848 wrote to memory of 1856	1848	04916727d46c51cfead87907320a208e1c0bc64cd3c11e24dd0c0d1cabaad74c.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1856

memory/1848-0-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1856-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1856-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1856-2-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1856-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1856-8-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1856-9-0x0000000073F92000-0x0000000073F94000-memory.dmp

Filesize
8KB

Download
memory/1856-13-0x0000000073F92000-0x0000000073F94000-memory.dmp

Filesize
8KB

Download