Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-03-2024 01:43

General

  • Target

    b37485bf19f9e5c3e33d6a02c8cd80c6.exe

  • Size

    604KB

  • MD5

    b37485bf19f9e5c3e33d6a02c8cd80c6

  • SHA1

    540bf3d4fb51db2368bebe216a7841d1ae8ba584

  • SHA256

    0540ea185c7bbc7adb63ed03f5b3578b0fdb04b2e9fc7d584f3f7ae415fc886a

  • SHA512

    e6cb2fa104dc85033c181610099640c9bc8397a6842329efa7a985f81aaa8f7d62978e187edb43ce3bf00c9c5e7971a3c7a2475f4e4bbc3ab2f838bc71798b6e

  • SSDEEP

    6144:WKWlw1DxXdp9fCEc2PI4Saq9JNl6zBY4o83fqysVufBn597NX2zE:W7lw1DxNp9fXHPIz3vtysgfBnnl2zE

Malware Config

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • RevengeRat Executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b37485bf19f9e5c3e33d6a02c8cd80c6.exe
    "C:\Users\Admin\AppData\Local\Temp\b37485bf19f9e5c3e33d6a02c8cd80c6.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe
      C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe -install -54401170 -chipde -7ea49ac586bf4240ac2459c190356a5f - -ChromeBundle -quvomeuluuwzdasy -197060
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:8

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe

    Filesize

    292KB

    MD5

    ad68076fb58a634cba05c9396b0f20af

    SHA1

    dabc08bdf0203f5946101a0eea51d494e87f67b9

    SHA256

    dc712ebab17c0bf8d73a1c5b5b3b053fd1e665a2d6ad21eb5a9b34da6e844a5a

    SHA512

    be7f294cd4835353ab121a2de655f4a99718096f078713bd1bc8c2d2a847937bafe6853b13bb7c41178f1b33aeacf3af3d13b80f1494cca4489472458a1b63ba

  • C:\Users\Admin\AppData\Local\Temp\OCS\quvomeuluuwzdasy.dat

    Filesize

    83B

    MD5

    fa628e4a19586d96c487b7de93837561

    SHA1

    e826cf9340b79b64aad3a63d56d0908142144bf5

    SHA256

    14c0ea261dc6e5b7fa0afca74f4b44574dcc308184c350a347f2e3dabb109844

    SHA512

    0b44050f41383b2d0ae93629af83ff532efed4928ae60a0cca2c80f141572c4e46f66baf68f8ef4d5fb83af2626974f13d895d16456da251c7366ebfc3804367

  • memory/8-13-0x00007FFDE7950000-0x00007FFDE82F1000-memory.dmp

    Filesize

    9.6MB

  • memory/8-10-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

    Filesize

    64KB

  • memory/8-11-0x000000001B670000-0x000000001B716000-memory.dmp

    Filesize

    664KB

  • memory/8-12-0x000000001C1A0000-0x000000001C23C000-memory.dmp

    Filesize

    624KB

  • memory/8-9-0x000000001BC30000-0x000000001C0FE000-memory.dmp

    Filesize

    4.8MB

  • memory/8-14-0x0000000001090000-0x0000000001098000-memory.dmp

    Filesize

    32KB

  • memory/8-8-0x00007FFDE7950000-0x00007FFDE82F1000-memory.dmp

    Filesize

    9.6MB

  • memory/8-16-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

    Filesize

    64KB

  • memory/8-17-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

    Filesize

    64KB

  • memory/8-18-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

    Filesize

    64KB

  • memory/8-20-0x00007FFDE7950000-0x00007FFDE82F1000-memory.dmp

    Filesize

    9.6MB