revengerat | f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1

Analysis

max time kernel
142s
max time network
145s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 05:02

Target

f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe
Size

951KB
MD5

0c0ca606518e34ce445417792014ffdd
SHA1

0364ead2131b253cb106a7f5c8a86e4a88475f65
SHA256

f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1
SHA512

c2da65513ca7fac94b772f5b423803b9e8075680d88f5b2694c19640ed45b33e771355e7f9493220f6443fe795150fd95eb06a1b072c9966829de64fad6932d5
SSDEEP

24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5j:Rh+ZkldDPK8YaKjj

Score

10^/10

Family

revengerat

Botnet

Marzo26

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Drops startup file 1 IoCs

Processes:

f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.

Processes:

resource yara_rule

behavioral1/memory/2768-0-0x00000000009D0000-0x0000000000AC3000-memory.dmp autoit_exe
behavioral1/memory/2768-13-0x00000000009D0000-0x0000000000AC3000-memory.dmp autoit_exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe

description pid process target process

PID 2768 set thread context of 2560 2768 f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 2560 RegAsm.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url	f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe

resource	yara_rule
behavioral1/memory/2768-0-0x00000000009D0000-0x0000000000AC3000-memory.dmp	autoit_exe
behavioral1/memory/2768-13-0x00000000009D0000-0x0000000000AC3000-memory.dmp	autoit_exe

description	pid	process	target process
PID 2768 set thread context of 2560	2768	f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2560	RegAsm.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe

pid	process
2768	f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe
2768	f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe
2768	f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe

pid	process
2768	f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe
2768	f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe
2768	f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe

description	pid	process	target process
PID 2768 wrote to memory of 2560	2768	f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe	RegAsm.exe
PID 2768 wrote to memory of 2560	2768	f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe	RegAsm.exe
PID 2768 wrote to memory of 2560	2768	f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe	RegAsm.exe
PID 2768 wrote to memory of 2560	2768	f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe	RegAsm.exe
PID 2768 wrote to memory of 2560	2768	f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe	RegAsm.exe
PID 2768 wrote to memory of 2560	2768	f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe	RegAsm.exe
PID 2768 wrote to memory of 2560	2768	f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe	RegAsm.exe
PID 2768 wrote to memory of 2560	2768	f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe	RegAsm.exe
PID 2768 wrote to memory of 2560	2768	f47e8dad93f737f1a4b353241ee7397fbbab20f95d363035cd0aa7a0bef688d1.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2560

memory/2560-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2560-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2560-2-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2560-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2560-8-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2560-9-0x00000000745E2000-0x00000000745E4000-memory.dmp

Filesize
8KB

Download
memory/2768-0-0x00000000009D0000-0x0000000000AC3000-memory.dmp

Filesize
972KB

Download
memory/2768-13-0x00000000009D0000-0x0000000000AC3000-memory.dmp

Filesize
972KB

Download