revengerat | 175b1d2670da9a11fce3b369eddb9236adc93dc53c57dfb6daf31d6cafabfd38

General

Target

175b1d2670da9a11fce3b369eddb9236adc93dc53c57dfb6daf31d6cafabfd38N.exe
Size

598KB
MD5

3172fe0833cfd9c5be0d658df94a1290
SHA1

28145a40e497d652942b02b203ed3cda8b0a43c2
SHA256

175b1d2670da9a11fce3b369eddb9236adc93dc53c57dfb6daf31d6cafabfd38
SHA512

60bb92bfc21bfe8545ea372da6d45e36823f7bdeb513feee178935afbb5c4abe78ace58923322ca0580942e423f5566f70a51d7e35185702f6214b11ac85f84b
SSDEEP

6144:AKWlw1DxD5ASIAfCEv2YUMNJlaJuNlK17Y4c83fhysVufBn597NX2P:A7lw1Dx15zfXeYU43fiysgfBnnl2P

Score

10^/10

revengerat discovery stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0007000000016ccc-5.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
1284	ocs_v71a.exe

Loads dropped DLL 2 IoCs

pid	Process
2568	175b1d2670da9a11fce3b369eddb9236adc93dc53c57dfb6daf31d6cafabfd38N.exe
2568	175b1d2670da9a11fce3b369eddb9236adc93dc53c57dfb6daf31d6cafabfd38N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	175b1d2670da9a11fce3b369eddb9236adc93dc53c57dfb6daf31d6cafabfd38N.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2568	175b1d2670da9a11fce3b369eddb9236adc93dc53c57dfb6daf31d6cafabfd38N.exe
1284	ocs_v71a.exe
1284	ocs_v71a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 1284	2568	175b1d2670da9a11fce3b369eddb9236adc93dc53c57dfb6daf31d6cafabfd38N.exe	30
PID 2568 wrote to memory of 1284	2568	175b1d2670da9a11fce3b369eddb9236adc93dc53c57dfb6daf31d6cafabfd38N.exe	30
PID 2568 wrote to memory of 1284	2568	175b1d2670da9a11fce3b369eddb9236adc93dc53c57dfb6daf31d6cafabfd38N.exe	30
PID 2568 wrote to memory of 1284	2568	175b1d2670da9a11fce3b369eddb9236adc93dc53c57dfb6daf31d6cafabfd38N.exe	30

C:\Users\Admin\AppData\Local\Temp\175b1d2670da9a11fce3b369eddb9236adc93dc53c57dfb6daf31d6cafabfd38N.exe
"C:\Users\Admin\AppData\Local\Temp\175b1d2670da9a11fce3b369eddb9236adc93dc53c57dfb6daf31d6cafabfd38N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe
  C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe -install -54443402 -chipde -22b1d35e39454a0d80ea65d848c5adff - -ChromeBundle -fctjjqhnvryimzqs -655704
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OCS\fctjjqhnvryimzqs.dat

Filesize
83B

MD5
831b9e8d9d331eaf11d652ab5228f78a

SHA1
af69148c9ef8c606bf9637feab759394a7ee5a95

SHA256
e6c8157575001beddbae4b5638cae1265526ddbf30a4aa7397a1761800346e38

SHA512
2915dcf430ca4d1969d9084744339a7b454eba2225e291f0975fde7a255b60412059b15b7d3fc91e2f6c537d804103d1dc6c46ea5bbbb23ca40ca2ee2ff8f1cd

Download Submit
\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe

Filesize
288KB

MD5
317ec5f92cfbf04a53e8125b66b3b4af

SHA1
16068b8977b4dc562ae782d91bc009472667e331

SHA256
7612ef3877c3e4e305a6c22941141601b489a73bc088622a40ebd93bee25bae5

SHA512
ed772da641a5c128677c4c285c648c1d8e539c34522b95c14f614797bb0d188571c7c257441d45598809aa3f8b4690bd53230282726e077c86c8d9fe71c1db65

Download Submit
memory/1284-19-0x000007FEF56A0000-0x000007FEF603D000-memory.dmp

Filesize
9.6MB

Download
memory/1284-20-0x000007FEF595E000-0x000007FEF595F000-memory.dmp

Filesize
4KB

Download
memory/1284-13-0x000007FEF56A0000-0x000007FEF603D000-memory.dmp

Filesize
9.6MB

Download
memory/1284-16-0x000007FEF56A0000-0x000007FEF603D000-memory.dmp

Filesize
9.6MB

Download
memory/1284-17-0x000007FEF56A0000-0x000007FEF603D000-memory.dmp

Filesize
9.6MB

Download
memory/1284-18-0x000007FEF56A0000-0x000007FEF603D000-memory.dmp

Filesize
9.6MB

Download
memory/1284-12-0x000007FEF595E000-0x000007FEF595F000-memory.dmp

Filesize
4KB

Download
memory/1284-14-0x000007FEF56A0000-0x000007FEF603D000-memory.dmp

Filesize
9.6MB

Download
memory/1284-21-0x000007FEF56A0000-0x000007FEF603D000-memory.dmp

Filesize
9.6MB

Download
memory/1284-22-0x000007FEF56A0000-0x000007FEF603D000-memory.dmp

Filesize
9.6MB

Download
memory/1284-23-0x000007FEF56A0000-0x000007FEF603D000-memory.dmp

Filesize
9.6MB

Download
memory/1284-24-0x000007FEF56A0000-0x000007FEF603D000-memory.dmp

Filesize
9.6MB

Download
memory/1284-25-0x000007FEF56A0000-0x000007FEF603D000-memory.dmp

Filesize
9.6MB

Download
memory/1284-26-0x000007FEF56A0000-0x000007FEF603D000-memory.dmp

Filesize
9.6MB

Download
memory/1284-27-0x000007FEF56A0000-0x000007FEF603D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing