Analysis
- max time kernel
94s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
23/01/2025, 22:58
General
- Target e5cf60cd5f60c75e75a6b5b03b9110fea919b33888f9bd97d7bf383e2310bca2.exe
- Size 598KB
- Sample250123-2xte8axmaz
- SHA256 e5cf60cd5f60c75e75a6b5b03b9110fea919b33888f9bd97d7bf383e2310bca2
Malware Config
Signatures
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- Revengerat family
- RevengeRat Executable 1 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5cf60cd5f60c75e75a6b5b03b9110fea919b33888f9bd97d7bf383e2310bca2.exe"C:\Users\Admin\AppData\Local\Temp\e5cf60cd5f60c75e75a6b5b03b9110fea919b33888f9bd97d7bf383e2310bca2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exeC:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe -install -54383364 -chipde -11ec508851b9429fbbf18a77eb03178c - -ChromeBundle -axrktzwvtrvzlbmt -5243662⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
axrktzwvtrvzlbmt.dat
ocs_v71a.exe
memory/4300-11-0x000000001BB20000-0x000000001BBC6000-memory.dmp
memory/4300-16-0x00007FFE720D0000-0x00007FFE72A71000-memory.dmp
memory/4300-10-0x000000001B5A0000-0x000000001BA6E000-memory.dmp
memory/4300-12-0x000000001BCE0000-0x000000001BD7C000-memory.dmp
memory/4300-13-0x00007FFE720D0000-0x00007FFE72A71000-memory.dmp
memory/4300-14-0x000000001BBE0000-0x000000001BBE8000-memory.dmp
memory/4300-8-0x00007FFE72385000-0x00007FFE72386000-memory.dmp
memory/4300-9-0x00007FFE720D0000-0x00007FFE72A71000-memory.dmp
memory/4300-17-0x00007FFE720D0000-0x00007FFE72A71000-memory.dmp
memory/4300-18-0x00007FFE720D0000-0x00007FFE72A71000-memory.dmp
memory/4300-19-0x00007FFE720D0000-0x00007FFE72A71000-memory.dmp
memory/4300-20-0x00007FFE720D0000-0x00007FFE72A71000-memory.dmp
memory/4300-21-0x00007FFE720D0000-0x00007FFE72A71000-memory.dmp
memory/4300-22-0x00007FFE72385000-0x00007FFE72386000-memory.dmp
memory/4300-23-0x00007FFE720D0000-0x00007FFE72A71000-memory.dmp
memory/4300-25-0x00007FFE720D0000-0x00007FFE72A71000-memory.dmp