revengerat | 1296e79f2f45727ddf54e317d6801b38b140fb6acb3a7659bb09e55d63f9d874

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1296e79f2f45727ddf54e317d6801b38b140fb6acb3a7659bb09e55d63f9d874N.exe
Size

598KB
MD5

a85a6f9b42fc4141bd8d112f0a096940
SHA1

89107edaae53118e7f343695f52718c5d4b53048
SHA256

1296e79f2f45727ddf54e317d6801b38b140fb6acb3a7659bb09e55d63f9d874
SHA512

c9650812cdcba374d4c6ff449f60f52f5ac26c6009a0be7e535c51ec1a6b9e32aef9ec69b9462a7a26da7118d31358cc3b15c59f98d374241a9cbbedaeb0c374
SSDEEP

6144:iKWlw1DxD9ASIAfCEv2YUMNJlaJuNlK17Y4c83fhysVufBn597NX2X:i7lw1Dxh5zfXeYU43fiysgfBnnl2X

Score

10^/10

revengerat discovery stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral2/files/0x0007000000023c8a-6.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
3584	ocs_v71a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1296e79f2f45727ddf54e317d6801b38b140fb6acb3a7659bb09e55d63f9d874N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3584	ocs_v71a.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1092	1296e79f2f45727ddf54e317d6801b38b140fb6acb3a7659bb09e55d63f9d874N.exe
3584	ocs_v71a.exe
3584	ocs_v71a.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 3584	1092	1296e79f2f45727ddf54e317d6801b38b140fb6acb3a7659bb09e55d63f9d874N.exe	85
PID 1092 wrote to memory of 3584	1092	1296e79f2f45727ddf54e317d6801b38b140fb6acb3a7659bb09e55d63f9d874N.exe	85

C:\Users\Admin\AppData\Local\Temp\1296e79f2f45727ddf54e317d6801b38b140fb6acb3a7659bb09e55d63f9d874N.exe
"C:\Users\Admin\AppData\Local\Temp\1296e79f2f45727ddf54e317d6801b38b140fb6acb3a7659bb09e55d63f9d874N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe
  C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe -install -54456225 -chipde -b982cc4d4b524940ab8f7c3cfc96b2d9 - -BLUB1 -sphpcelpujleuivg -655462
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe

Filesize
288KB

MD5
317ec5f92cfbf04a53e8125b66b3b4af

SHA1
16068b8977b4dc562ae782d91bc009472667e331

SHA256
7612ef3877c3e4e305a6c22941141601b489a73bc088622a40ebd93bee25bae5

SHA512
ed772da641a5c128677c4c285c648c1d8e539c34522b95c14f614797bb0d188571c7c257441d45598809aa3f8b4690bd53230282726e077c86c8d9fe71c1db65

Download Submit
C:\Users\Admin\AppData\Local\Temp\OCS\sphpcelpujleuivg.dat

Filesize
83B

MD5
a5256b750779b9a144566b7e75e56ef3

SHA1
5de9968ca34b32520baefa5b9288df054e69e036

SHA256
55f427a762288f7e585ae0e85f5b83909225c2f3f1db2f3ba31579eea84fb91e

SHA512
825e7b00c3fb971bfb40862f069658b4795010746385bd16bbaec632b8478c23a0dec25369283fb3761c666abb637f17b46b2896d87bd88111a112c4319a88c7

Download Submit
memory/3584-15-0x00007FFAF2B00000-0x00007FFAF34A1000-memory.dmp

Filesize
9.6MB

Download
memory/3584-16-0x00007FFAF2B00000-0x00007FFAF34A1000-memory.dmp

Filesize
9.6MB

Download
memory/3584-11-0x000000001BD60000-0x000000001BE06000-memory.dmp

Filesize
664KB

Download
memory/3584-12-0x000000001BEB0000-0x000000001BF4C000-memory.dmp

Filesize
624KB

Download
memory/3584-13-0x0000000000D50000-0x0000000000D58000-memory.dmp

Filesize
32KB

Download
memory/3584-9-0x000000001B7E0000-0x000000001BCAE000-memory.dmp

Filesize
4.8MB

Download
memory/3584-8-0x00007FFAF2DB5000-0x00007FFAF2DB6000-memory.dmp

Filesize
4KB

Download
memory/3584-10-0x00007FFAF2B00000-0x00007FFAF34A1000-memory.dmp

Filesize
9.6MB

Download
memory/3584-17-0x00007FFAF2B00000-0x00007FFAF34A1000-memory.dmp

Filesize
9.6MB

Download
memory/3584-18-0x00007FFAF2B00000-0x00007FFAF34A1000-memory.dmp

Filesize
9.6MB

Download
memory/3584-19-0x00007FFAF2B00000-0x00007FFAF34A1000-memory.dmp

Filesize
9.6MB

Download
memory/3584-20-0x00007FFAF2B00000-0x00007FFAF34A1000-memory.dmp

Filesize
9.6MB

Download
memory/3584-21-0x00007FFAF2B00000-0x00007FFAF34A1000-memory.dmp

Filesize
9.6MB

Download
memory/3584-22-0x00007FFAF2DB5000-0x00007FFAF2DB6000-memory.dmp

Filesize
4KB

Download
memory/3584-23-0x00007FFAF2B00000-0x00007FFAF34A1000-memory.dmp

Filesize
9.6MB

Download
memory/3584-25-0x00007FFAF2B00000-0x00007FFAF34A1000-memory.dmp

Filesize
9.6MB

Download