revengerat | ff3c8c522482eee98c32bc9603afe4dad13099c2fb8e8c5a0603ea8b2db03362

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2024 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff3c8c522482eee98c32bc9603afe4dad13099c2fb8e8c5a0603ea8b2db03362.exe
Size

600KB
MD5

597e7f369f75fe5a16443f3b3c7f54de
SHA1

3be2732c1745731b238148c5d1bbf7cbfd504bac
SHA256

ff3c8c522482eee98c32bc9603afe4dad13099c2fb8e8c5a0603ea8b2db03362
SHA512

b8701cae2e91e771974a0c7aee147394b624d71b46b52b3b5fffc789a11ed958b873b4b9e1dcf5159964187fde6d2035cb3b1314ddec88802e1801dac63c697d
SSDEEP

6144:aKWlw1DxDnASIAfCEv2YUMNJlaJuNlK17Y4c83fhysVufBn597NX2ph:a7lw1DxD5zfXeYU43fiysgfBnnl2ph

Score

10^/10

revengerat discovery stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

RevengeRat Executable 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/files/0x000a000000023b7f-7.dat	revengerat

Executes dropped EXE 1 IoCs

Processes:

ocs_v71a.exe

pid	Process
3892	ocs_v71a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ff3c8c522482eee98c32bc9603afe4dad13099c2fb8e8c5a0603ea8b2db03362.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff3c8c522482eee98c32bc9603afe4dad13099c2fb8e8c5a0603ea8b2db03362.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ocs_v71a.exe

description	pid	Process
Token: SeDebugPrivilege	3892	ocs_v71a.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

ff3c8c522482eee98c32bc9603afe4dad13099c2fb8e8c5a0603ea8b2db03362.exeocs_v71a.exe

pid	Process
3220	ff3c8c522482eee98c32bc9603afe4dad13099c2fb8e8c5a0603ea8b2db03362.exe
3892	ocs_v71a.exe
3892	ocs_v71a.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

ff3c8c522482eee98c32bc9603afe4dad13099c2fb8e8c5a0603ea8b2db03362.exe

description	pid	Process	procid_target
PID 3220 wrote to memory of 3892	3220	ff3c8c522482eee98c32bc9603afe4dad13099c2fb8e8c5a0603ea8b2db03362.exe	82
PID 3220 wrote to memory of 3892	3220	ff3c8c522482eee98c32bc9603afe4dad13099c2fb8e8c5a0603ea8b2db03362.exe	82

C:\Users\Admin\AppData\Local\Temp\ff3c8c522482eee98c32bc9603afe4dad13099c2fb8e8c5a0603ea8b2db03362.exe
"C:\Users\Admin\AppData\Local\Temp\ff3c8c522482eee98c32bc9603afe4dad13099c2fb8e8c5a0603ea8b2db03362.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe
  C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe -install -54383364 -chipde -f90379f0b8db4a66955a8391d2dd3edb - -BLUB1 -tseanxhzcdygszlt -327826
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe

Filesize
288KB

MD5
317ec5f92cfbf04a53e8125b66b3b4af

SHA1
16068b8977b4dc562ae782d91bc009472667e331

SHA256
7612ef3877c3e4e305a6c22941141601b489a73bc088622a40ebd93bee25bae5

SHA512
ed772da641a5c128677c4c285c648c1d8e539c34522b95c14f614797bb0d188571c7c257441d45598809aa3f8b4690bd53230282726e077c86c8d9fe71c1db65

Download Submit
C:\Users\Admin\AppData\Local\Temp\OCS\tseanxhzcdygszlt.dat

Filesize
81B

MD5
f8a2551280d2240714fa339a96c42797

SHA1
6c2294d26e7de9b489d6bfd6012f66f8132378a3

SHA256
fb3563b426e0b2e5203139a9baf0da92aad0a948cce74b9605f96bef1640636a

SHA512
cba134a0d2e971a9942f7f67ba4f2bb29b271fbbafd57d1faff242a6f27288a54b36cd8fdabdbeb568a541fb2c9adab23d608e3a51f80ff095560b5797620630

Download Submit
memory/3892-11-0x000000001C1F0000-0x000000001C296000-memory.dmp

Filesize
664KB

Download
memory/3892-16-0x00007FFEC6260000-0x00007FFEC6C01000-memory.dmp

Filesize
9.6MB

Download
memory/3892-10-0x000000001BC70000-0x000000001C13E000-memory.dmp

Filesize
4.8MB

Download
memory/3892-12-0x000000001C340000-0x000000001C3DC000-memory.dmp

Filesize
624KB

Download
memory/3892-13-0x00000000011F0000-0x00000000011F8000-memory.dmp

Filesize
32KB

Download
memory/3892-15-0x00007FFEC6260000-0x00007FFEC6C01000-memory.dmp

Filesize
9.6MB

Download
memory/3892-8-0x00007FFEC6515000-0x00007FFEC6516000-memory.dmp

Filesize
4KB

Download
memory/3892-9-0x00007FFEC6260000-0x00007FFEC6C01000-memory.dmp

Filesize
9.6MB

Download
memory/3892-17-0x00007FFEC6260000-0x00007FFEC6C01000-memory.dmp

Filesize
9.6MB

Download
memory/3892-18-0x00007FFEC6260000-0x00007FFEC6C01000-memory.dmp

Filesize
9.6MB

Download
memory/3892-19-0x00007FFEC6260000-0x00007FFEC6C01000-memory.dmp

Filesize
9.6MB

Download
memory/3892-20-0x00007FFEC6260000-0x00007FFEC6C01000-memory.dmp

Filesize
9.6MB

Download
memory/3892-21-0x00007FFEC6260000-0x00007FFEC6C01000-memory.dmp

Filesize
9.6MB

Download
memory/3892-22-0x00007FFEC6515000-0x00007FFEC6516000-memory.dmp

Filesize
4KB

Download
memory/3892-23-0x00007FFEC6260000-0x00007FFEC6C01000-memory.dmp

Filesize
9.6MB

Download
memory/3892-25-0x00007FFEC6260000-0x00007FFEC6C01000-memory.dmp

Filesize
9.6MB

Download