revengerat | 13ba447dcb062468e18a6b7deed7bf6973202631a4995e2dcc26952cbdadb450

General

Target

13ba447dcb062468e18a6b7deed7bf6973202631a4995e2dcc26952cbdadb450N.exe
Size

604KB
MD5

ce78bb7b35526510a47fdfbbe9e12da0
SHA1

58ba52b79c1853e4c8eb20e5e8ee23c7fa509125
SHA256

13ba447dcb062468e18a6b7deed7bf6973202631a4995e2dcc26952cbdadb450
SHA512

32ccca8a6d62105da60b4968da46a71bba20ab078450b195c55e9693adaa7afaf60041791236c4113372b4d51a4986c220b4298d500a8efdc0e4fa085d3b552c
SSDEEP

6144:xKWlw1DxX+p9fCEc2PI4Saq9JNl6zBY4o83fqysVufBn597NX20p:x7lw1Dxup9fXHPIz3vtysgfBnnl20p

Score

10^/10

revengerat discovery stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0007000000016fc9-5.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
2792	ocs_v71.exe

Loads dropped DLL 2 IoCs

pid	Process
2860	13ba447dcb062468e18a6b7deed7bf6973202631a4995e2dcc26952cbdadb450N.exe
2860	13ba447dcb062468e18a6b7deed7bf6973202631a4995e2dcc26952cbdadb450N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13ba447dcb062468e18a6b7deed7bf6973202631a4995e2dcc26952cbdadb450N.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2860	13ba447dcb062468e18a6b7deed7bf6973202631a4995e2dcc26952cbdadb450N.exe
2792	ocs_v71.exe
2792	ocs_v71.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2792	2860	13ba447dcb062468e18a6b7deed7bf6973202631a4995e2dcc26952cbdadb450N.exe	30
PID 2860 wrote to memory of 2792	2860	13ba447dcb062468e18a6b7deed7bf6973202631a4995e2dcc26952cbdadb450N.exe	30
PID 2860 wrote to memory of 2792	2860	13ba447dcb062468e18a6b7deed7bf6973202631a4995e2dcc26952cbdadb450N.exe	30
PID 2860 wrote to memory of 2792	2860	13ba447dcb062468e18a6b7deed7bf6973202631a4995e2dcc26952cbdadb450N.exe	30

C:\Users\Admin\AppData\Local\Temp\13ba447dcb062468e18a6b7deed7bf6973202631a4995e2dcc26952cbdadb450N.exe
"C:\Users\Admin\AppData\Local\Temp\13ba447dcb062468e18a6b7deed7bf6973202631a4995e2dcc26952cbdadb450N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe
  C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe -install -54403718 -chipde -fc78f0b7a9dc434ba265ecb81e2ddcf9 - -ChromeBundle -qtzcxxpzduvcwuib -524682
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OCS\qtzcxxpzduvcwuib.dat

Filesize
83B

MD5
5e68fb71175ec3d064dec72b67a904fd

SHA1
75b47cd4e4014edcbf9f0554d7266f5bc863f835

SHA256
ae765df4937f726782d28803c8cc8f2ddac560c18519994d628ad2fad3928d68

SHA512
73fbc65bbb458843a66c3ca1a76a1377df28f4ba975ce4724c4c1ab275769253eb44bab17579abbe8fb8c20b79c0db3d25eba6048a26fb8a1d413e4b0407d000

Download Submit
\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe

Filesize
292KB

MD5
ad68076fb58a634cba05c9396b0f20af

SHA1
dabc08bdf0203f5946101a0eea51d494e87f67b9

SHA256
dc712ebab17c0bf8d73a1c5b5b3b053fd1e665a2d6ad21eb5a9b34da6e844a5a

SHA512
be7f294cd4835353ab121a2de655f4a99718096f078713bd1bc8c2d2a847937bafe6853b13bb7c41178f1b33aeacf3af3d13b80f1494cca4489472458a1b63ba

Download Submit
memory/2792-19-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-20-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-13-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-16-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-17-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-18-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-12-0x000007FEF53BE000-0x000007FEF53BF000-memory.dmp

Filesize
4KB

Download
memory/2792-14-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-21-0x000007FEF53BE000-0x000007FEF53BF000-memory.dmp

Filesize
4KB

Download
memory/2792-22-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-23-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-24-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-25-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-26-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-27-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing