revengerat | 27cca9a5246f66df5b30c20977a393977d0d93feb07eb09783867e6bae3dc4a8

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27cca9a5246f66df5b30c20977a393977d0d93feb07eb09783867e6bae3dc4a8.exe
Size

600KB
MD5

6953c1d0d1c92b74cd854541983f62ca
SHA1

54d7c95c7b470894f076126cffe540c1cbd70ad7
SHA256

27cca9a5246f66df5b30c20977a393977d0d93feb07eb09783867e6bae3dc4a8
SHA512

ec734b63173688cee08204204ee6bdd69f470533ad6291791ae2bf5e90b774f38d07e4457949990eeecf160486a403698d5b6600fb06e596cd25d0375cdc8e40
SSDEEP

6144:uKWlw1DxDIASIAfCEv2YUMNJlaJuNlK17Y4c83fhysVufBn597NX2w:u7lw1Dx05zfXeYU43fiysgfBnnl2w

Score

10^/10

revengerat discovery stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral2/files/0x0008000000023bd9-6.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
2428	ocs_v71a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27cca9a5246f66df5b30c20977a393977d0d93feb07eb09783867e6bae3dc4a8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	ocs_v71a.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4600	27cca9a5246f66df5b30c20977a393977d0d93feb07eb09783867e6bae3dc4a8.exe
2428	ocs_v71a.exe
2428	ocs_v71a.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 2428	4600	27cca9a5246f66df5b30c20977a393977d0d93feb07eb09783867e6bae3dc4a8.exe	82
PID 4600 wrote to memory of 2428	4600	27cca9a5246f66df5b30c20977a393977d0d93feb07eb09783867e6bae3dc4a8.exe	82

C:\Users\Admin\AppData\Local\Temp\27cca9a5246f66df5b30c20977a393977d0d93feb07eb09783867e6bae3dc4a8.exe
"C:\Users\Admin\AppData\Local\Temp\27cca9a5246f66df5b30c20977a393977d0d93feb07eb09783867e6bae3dc4a8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe
  C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe -install -54403718 -chipde -645ca2e97d2045dba7e10c36b92eab7d - -ChromeBundle -lbulotvcnixqygst -459274
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OCS\lbulotvcnixqygst.dat

Filesize
83B

MD5
4225a6ff738ebfe341940389bf42ce84

SHA1
be71a1c71c3eb316624add95e06491e088e5cd2d

SHA256
9814e40721a960c4019b2d8fd2107c70a726cdf055c64f638c6b4c98e5263b30

SHA512
7283a45b14878ae5fc832d7b06bd7557386306022f05ceb41be6cda5ce02f5bcb0462acc4d034b28810482204cc2e466cc67bf3b20889b949e9f1035d35cdb29

Download Submit
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe

Filesize
288KB

MD5
317ec5f92cfbf04a53e8125b66b3b4af

SHA1
16068b8977b4dc562ae782d91bc009472667e331

SHA256
7612ef3877c3e4e305a6c22941141601b489a73bc088622a40ebd93bee25bae5

SHA512
ed772da641a5c128677c4c285c648c1d8e539c34522b95c14f614797bb0d188571c7c257441d45598809aa3f8b4690bd53230282726e077c86c8d9fe71c1db65

Download Submit
memory/2428-11-0x000000001BE90000-0x000000001BF2C000-memory.dmp

Filesize
624KB

Download
memory/2428-16-0x00007FFEF6680000-0x00007FFEF7021000-memory.dmp

Filesize
9.6MB

Download
memory/2428-9-0x000000001B800000-0x000000001BCCE000-memory.dmp

Filesize
4.8MB

Download
memory/2428-12-0x00007FFEF6680000-0x00007FFEF7021000-memory.dmp

Filesize
9.6MB

Download
memory/2428-13-0x000000001BD90000-0x000000001BD98000-memory.dmp

Filesize
32KB

Download
memory/2428-14-0x00007FFEF6680000-0x00007FFEF7021000-memory.dmp

Filesize
9.6MB

Download
memory/2428-8-0x00007FFEF6935000-0x00007FFEF6936000-memory.dmp

Filesize
4KB

Download
memory/2428-10-0x000000001BCD0000-0x000000001BD76000-memory.dmp

Filesize
664KB

Download
memory/2428-17-0x00007FFEF6680000-0x00007FFEF7021000-memory.dmp

Filesize
9.6MB

Download
memory/2428-18-0x00007FFEF6680000-0x00007FFEF7021000-memory.dmp

Filesize
9.6MB

Download
memory/2428-19-0x00007FFEF6680000-0x00007FFEF7021000-memory.dmp

Filesize
9.6MB

Download
memory/2428-20-0x00007FFEF6680000-0x00007FFEF7021000-memory.dmp

Filesize
9.6MB

Download
memory/2428-21-0x00007FFEF6680000-0x00007FFEF7021000-memory.dmp

Filesize
9.6MB

Download
memory/2428-22-0x00007FFEF6935000-0x00007FFEF6936000-memory.dmp

Filesize
4KB

Download
memory/2428-23-0x00007FFEF6680000-0x00007FFEF7021000-memory.dmp

Filesize
9.6MB

Download
memory/2428-25-0x00007FFEF6680000-0x00007FFEF7021000-memory.dmp

Filesize
9.6MB

Download