revengerat | 14e2f34e9487e56e9efa7a536ab144adb5ddd01b9f6ce295545f83fa9a334dcc

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfe379cfb4a3ee35c15e6012303f3259.exe
Size

614KB
MD5

bfe379cfb4a3ee35c15e6012303f3259
SHA1

08b3ada04639e1c04a560622cff2c7f37b407ed9
SHA256

14e2f34e9487e56e9efa7a536ab144adb5ddd01b9f6ce295545f83fa9a334dcc
SHA512

f2d4f79a15d912068e8aee56534a8bd48c0edc86502a31aba2cfda7a3c6d4b0ddda24401416f60264bd47503069a1b4cfed5ca91aa1a3100081d723ef10b2caa
SSDEEP

12288:37lw1DxEpefX4qkkn9wifVzo6mj+ysgfBnnl2Q:37m1DMqkknljmj+ysgpnncQ

Score

10^/10

revengerat stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71b.exe	revengerat

Executes dropped EXE 1 IoCs

Processes:

ocs_v71b.exe

pid process

3776 ocs_v71b.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ocs_v71b.exe

description pid process

Token: SeDebugPrivilege 3776 ocs_v71b.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

bfe379cfb4a3ee35c15e6012303f3259.exeocs_v71b.exe

pid process

2212 bfe379cfb4a3ee35c15e6012303f3259.exe
3776 ocs_v71b.exe
3776 ocs_v71b.exe

pid	process
3776	ocs_v71b.exe

description	pid	process
Token: SeDebugPrivilege	3776	ocs_v71b.exe

pid	process
2212	bfe379cfb4a3ee35c15e6012303f3259.exe
3776	ocs_v71b.exe
3776	ocs_v71b.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

bfe379cfb4a3ee35c15e6012303f3259.exe

description	pid	process	target process
PID 2212 wrote to memory of 3776	2212	bfe379cfb4a3ee35c15e6012303f3259.exe	ocs_v71b.exe
PID 2212 wrote to memory of 3776	2212	bfe379cfb4a3ee35c15e6012303f3259.exe	ocs_v71b.exe

C:\Users\Admin\AppData\Local\Temp\bfe379cfb4a3ee35c15e6012303f3259.exe
"C:\Users\Admin\AppData\Local\Temp\bfe379cfb4a3ee35c15e6012303f3259.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212

C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71b.exe
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71b.exe -install -54383364 -chipde -e5a2ae1362a94a3f85699f2e070ce979 - -BLUB2 -vcgcgujqpgtexmrz -262508
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71b.exe
Filesize
304KB

MD5
7b3b5db5fdd271811f9f22d52ee36e9d

SHA1
dae3b80a567aa739fa54d4c896a2cfe0f9718180

SHA256
c5e83f41df5b4158994a29122874c3ff26d5e5877eb9a1dc109693d8ea41cea2

SHA512
91ae6be31c599344f44fc5decd2d51f7ff2e86da53089c8f5a821c71853c0603e613c2455eedbf55970bda34e2f74547105b27d53dfdf5c47b81e648cdc3ced2

Download Submit
C:\Users\Admin\AppData\Local\Temp\OCS\vcgcgujqpgtexmrz.dat
Filesize
81B

MD5
c5cbbc160a47cca8176daf147c4e4013

SHA1
5e62f13d809d5496e52784486e9dc99404410d41

SHA256
286bf920a94d093210c92bda1a8b1036992714d9aa434497e3f50f9cb70276fa

SHA512
c1f8a9cd10e111d89aff0687febb1bb9658d9e06482c5b5d6794986fc315038d1dea3ce987522cd0ed937d06bbd42b6cc4a09b6e3b7c325abae6fe93cb63f114

Download Submit
memory/3776-13-0x000000001C780000-0x000000001C81C000-memory.dmp

Filesize
624KB

Download
memory/3776-10-0x0000000001800000-0x0000000001810000-memory.dmp

Filesize
64KB

Download
memory/3776-11-0x000000001C630000-0x000000001C6D6000-memory.dmp

Filesize
664KB

Download
memory/3776-12-0x00007FFBD96A0000-0x00007FFBDA041000-memory.dmp

Filesize
9.6MB

Download
memory/3776-9-0x00007FFBD96A0000-0x00007FFBDA041000-memory.dmp

Filesize
9.6MB

Download
memory/3776-14-0x0000000001610000-0x0000000001618000-memory.dmp

Filesize
32KB

Download
memory/3776-8-0x000000001C0B0000-0x000000001C57E000-memory.dmp

Filesize
4.8MB

Download
memory/3776-16-0x0000000001800000-0x0000000001810000-memory.dmp

Filesize
64KB

Download
memory/3776-17-0x0000000001800000-0x0000000001810000-memory.dmp

Filesize
64KB

Download
memory/3776-18-0x0000000001800000-0x0000000001810000-memory.dmp

Filesize
64KB

Download
memory/3776-19-0x0000000001800000-0x0000000001810000-memory.dmp

Filesize
64KB

Download
memory/3776-20-0x0000000001800000-0x0000000001810000-memory.dmp

Filesize
64KB

Download
memory/3776-22-0x00007FFBD96A0000-0x00007FFBDA041000-memory.dmp

Filesize
9.6MB

Download