revengerat | 14e0e9ac8ab44c91206a4ea45f4b7c35287e07c10f90180541e26383e0b7a16a

Analysis

max time kernel
105s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24/01/2025, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14e0e9ac8ab44c91206a4ea45f4b7c35287e07c10f90180541e26383e0b7a16aN.exe
Size

598KB
MD5

8d186ef9c5fd3d9a3366c0365e9545c0
SHA1

4cd3cfa26bed366a939c52f8f49229778d1d5775
SHA256

14e0e9ac8ab44c91206a4ea45f4b7c35287e07c10f90180541e26383e0b7a16a
SHA512

1920dbbb2152576e818f64b31ba85e24f0583080b8332a7f93db3b6ab3edc6a77617edadbff47f60d02e33ab608ac02c3ce58e3d15c82a8348199c3c56823b6c
SSDEEP

6144:0KWlw1DxDEASIAfCEv2YUMNJlaJuNlK17Y4c83fhysVufBn597NX2z:07lw1DxY5zfXeYU43fiysgfBnnl2z

Score

10^/10

revengerat discovery stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x00070000000167ea-5.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
2496	ocs_v71a.exe

Loads dropped DLL 2 IoCs

pid	Process
2336	14e0e9ac8ab44c91206a4ea45f4b7c35287e07c10f90180541e26383e0b7a16aN.exe
2336	14e0e9ac8ab44c91206a4ea45f4b7c35287e07c10f90180541e26383e0b7a16aN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14e0e9ac8ab44c91206a4ea45f4b7c35287e07c10f90180541e26383e0b7a16aN.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2336	14e0e9ac8ab44c91206a4ea45f4b7c35287e07c10f90180541e26383e0b7a16aN.exe
2496	ocs_v71a.exe
2496	ocs_v71a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2496	2336	14e0e9ac8ab44c91206a4ea45f4b7c35287e07c10f90180541e26383e0b7a16aN.exe	31
PID 2336 wrote to memory of 2496	2336	14e0e9ac8ab44c91206a4ea45f4b7c35287e07c10f90180541e26383e0b7a16aN.exe	31
PID 2336 wrote to memory of 2496	2336	14e0e9ac8ab44c91206a4ea45f4b7c35287e07c10f90180541e26383e0b7a16aN.exe	31
PID 2336 wrote to memory of 2496	2336	14e0e9ac8ab44c91206a4ea45f4b7c35287e07c10f90180541e26383e0b7a16aN.exe	31

C:\Users\Admin\AppData\Local\Temp\14e0e9ac8ab44c91206a4ea45f4b7c35287e07c10f90180541e26383e0b7a16aN.exe
"C:\Users\Admin\AppData\Local\Temp\14e0e9ac8ab44c91206a4ea45f4b7c35287e07c10f90180541e26383e0b7a16aN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe
  C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe -install -54397117 -chipde -a924a82c6aec45dca001e58326af120b - -ChromeBundle -jqyaqkhhgnjhtsuc -393562
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OCS\jqyaqkhhgnjhtsuc.dat

Filesize
85B

MD5
536ae26decbf402280846ffc1a8505c9

SHA1
35bb2937d82dd9bb6e98a7e0948a82eb461c9f34

SHA256
3749331d6b0bc29df4431f6bac252b1efa21610386af868494b6a49fc06dbeee

SHA512
cf1b9de7b91f024afb56a53569f82b71cdf7d8c248a0b5ebace7fcaf4adb2393d7d4aa1a1e1b224625b15fb77070412e86b92e4f3dec18895f1876932fa7f721

Download Submit
\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe

Filesize
288KB

MD5
317ec5f92cfbf04a53e8125b66b3b4af

SHA1
16068b8977b4dc562ae782d91bc009472667e331

SHA256
7612ef3877c3e4e305a6c22941141601b489a73bc088622a40ebd93bee25bae5

SHA512
ed772da641a5c128677c4c285c648c1d8e539c34522b95c14f614797bb0d188571c7c257441d45598809aa3f8b4690bd53230282726e077c86c8d9fe71c1db65

Download Submit
memory/2496-17-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2496-14-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2496-15-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2496-16-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2496-12-0x000007FEF610E000-0x000007FEF610F000-memory.dmp

Filesize
4KB

Download
memory/2496-18-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2496-19-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2496-20-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2496-21-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2496-22-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2496-23-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download