Analysis
- max time kernel
93s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
08/01/2025, 10:41
General
- Target d7004ef7e7a19f4456f79ddbff8d084caecdce4626e090a06a705cf8c49015d2N.exe
- Size 598KB
- Sample250108-mra95awpbw
- SHA256 d7004ef7e7a19f4456f79ddbff8d084caecdce4626e090a06a705cf8c49015d2
Malware Config
Signatures
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- Revengerat family
- RevengeRat Executable 1 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7004ef7e7a19f4456f79ddbff8d084caecdce4626e090a06a705cf8c49015d2N.exe"C:\Users\Admin\AppData\Local\Temp\d7004ef7e7a19f4456f79ddbff8d084caecdce4626e090a06a705cf8c49015d2N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exeC:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe -install -145 -dhtechradar -c23adceeec6444c98f1875766c37a7fc - -ChromeBundle -gjrgtlcgebpypnhy -3937062⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
gjrgtlcgebpypnhy.dat
ocs_v71a.exe
memory/960-10-0x00007FFB42A70000-0x00007FFB43411000-memory.dmp
memory/960-18-0x00007FFB42A70000-0x00007FFB43411000-memory.dmp
memory/960-9-0x000000001C290000-0x000000001C75E000-memory.dmp
memory/960-12-0x000000001C800000-0x000000001C89C000-memory.dmp
memory/960-13-0x00000000018B0000-0x00000000018B8000-memory.dmp
memory/960-14-0x00007FFB42A70000-0x00007FFB43411000-memory.dmp
memory/960-8-0x00007FFB42D25000-0x00007FFB42D26000-memory.dmp
memory/960-16-0x00007FFB42A70000-0x00007FFB43411000-memory.dmp
memory/960-17-0x00007FFB42A70000-0x00007FFB43411000-memory.dmp
memory/960-11-0x000000001BCB0000-0x000000001BD56000-memory.dmp
memory/960-19-0x00007FFB42A70000-0x00007FFB43411000-memory.dmp
memory/960-20-0x00007FFB42A70000-0x00007FFB43411000-memory.dmp
memory/960-21-0x00007FFB42D25000-0x00007FFB42D26000-memory.dmp
memory/960-22-0x00007FFB42A70000-0x00007FFB43411000-memory.dmp
memory/960-23-0x00007FFB42A70000-0x00007FFB43411000-memory.dmp
memory/960-24-0x00007FFB42A70000-0x00007FFB43411000-memory.dmp
memory/960-26-0x00007FFB42A70000-0x00007FFB43411000-memory.dmp