revengerat | 0540ea185c7bbc7adb63ed03f5b3578b0fdb04b2e9fc7d584f3f7ae415fc886a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b37485bf19f9e5c3e33d6a02c8cd80c6.exe
Size

604KB
MD5

b37485bf19f9e5c3e33d6a02c8cd80c6
SHA1

540bf3d4fb51db2368bebe216a7841d1ae8ba584
SHA256

0540ea185c7bbc7adb63ed03f5b3578b0fdb04b2e9fc7d584f3f7ae415fc886a
SHA512

e6cb2fa104dc85033c181610099640c9bc8397a6842329efa7a985f81aaa8f7d62978e187edb43ce3bf00c9c5e7971a3c7a2475f4e4bbc3ab2f838bc71798b6e
SSDEEP

6144:WKWlw1DxXdp9fCEc2PI4Saq9JNl6zBY4o83fqysVufBn597NX2zE:W7lw1DxNp9fXHPIz3vtysgfBnnl2zE

Score

10^/10

revengerat stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe	revengerat

Executes dropped EXE 1 IoCs

Processes:

ocs_v71.exe

pid process

2308 ocs_v71.exe
Loads dropped DLL 2 IoCs

Processes:

b37485bf19f9e5c3e33d6a02c8cd80c6.exe

pid process

2276 b37485bf19f9e5c3e33d6a02c8cd80c6.exe
2276 b37485bf19f9e5c3e33d6a02c8cd80c6.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

b37485bf19f9e5c3e33d6a02c8cd80c6.exeocs_v71.exe

pid process

2276 b37485bf19f9e5c3e33d6a02c8cd80c6.exe
2308 ocs_v71.exe
2308 ocs_v71.exe

pid	process
2308	ocs_v71.exe

pid	process
2276	b37485bf19f9e5c3e33d6a02c8cd80c6.exe
2276	b37485bf19f9e5c3e33d6a02c8cd80c6.exe

pid	process
2276	b37485bf19f9e5c3e33d6a02c8cd80c6.exe
2308	ocs_v71.exe
2308	ocs_v71.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b37485bf19f9e5c3e33d6a02c8cd80c6.exe

description	pid	process	target process
PID 2276 wrote to memory of 2308	2276	b37485bf19f9e5c3e33d6a02c8cd80c6.exe	ocs_v71.exe
PID 2276 wrote to memory of 2308	2276	b37485bf19f9e5c3e33d6a02c8cd80c6.exe	ocs_v71.exe
PID 2276 wrote to memory of 2308	2276	b37485bf19f9e5c3e33d6a02c8cd80c6.exe	ocs_v71.exe
PID 2276 wrote to memory of 2308	2276	b37485bf19f9e5c3e33d6a02c8cd80c6.exe	ocs_v71.exe

C:\Users\Admin\AppData\Local\Temp\b37485bf19f9e5c3e33d6a02c8cd80c6.exe
"C:\Users\Admin\AppData\Local\Temp\b37485bf19f9e5c3e33d6a02c8cd80c6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276

C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe -install -54401170 -chipde -7ea49ac586bf4240ac2459c190356a5f - -ChromeBundle -ipqodezgzdyffrxv -393504
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OCS\ipqodezgzdyffrxv.dat
Filesize
83B

MD5
fa628e4a19586d96c487b7de93837561

SHA1
e826cf9340b79b64aad3a63d56d0908142144bf5

SHA256
14c0ea261dc6e5b7fa0afca74f4b44574dcc308184c350a347f2e3dabb109844

SHA512
0b44050f41383b2d0ae93629af83ff532efed4928ae60a0cca2c80f141572c4e46f66baf68f8ef4d5fb83af2626974f13d895d16456da251c7366ebfc3804367

Download Submit
\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe
Filesize
292KB

MD5
ad68076fb58a634cba05c9396b0f20af

SHA1
dabc08bdf0203f5946101a0eea51d494e87f67b9

SHA256
dc712ebab17c0bf8d73a1c5b5b3b053fd1e665a2d6ad21eb5a9b34da6e844a5a

SHA512
be7f294cd4835353ab121a2de655f4a99718096f078713bd1bc8c2d2a847937bafe6853b13bb7c41178f1b33aeacf3af3d13b80f1494cca4489472458a1b63ba

Download Submit
memory/2308-12-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/2308-14-0x00000000020B0000-0x0000000002130000-memory.dmp

Filesize
512KB

Download
memory/2308-15-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/2308-16-0x00000000020B0000-0x0000000002130000-memory.dmp

Filesize
512KB

Download
memory/2308-17-0x00000000020B0000-0x0000000002130000-memory.dmp

Filesize
512KB

Download
memory/2308-18-0x00000000020B0000-0x0000000002130000-memory.dmp

Filesize
512KB

Download
memory/2308-19-0x00000000020B0000-0x0000000002130000-memory.dmp

Filesize
512KB

Download
memory/2308-20-0x00000000020B0000-0x0000000002130000-memory.dmp

Filesize
512KB

Download
memory/2308-21-0x00000000020B0000-0x0000000002130000-memory.dmp

Filesize
512KB

Download
memory/2308-22-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download