Overview

overview

10

Static

static

1

224574dfe9...aN.exe

windows7-x64

10

224574dfe9...aN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2025, 02:28 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    224574dfe9c295dfd6f4c1c078be410a05a2dac8ef368562a472a8fad9c3e23aN.exe

  • Size

    600KB

  • MD5

    893b2032f69dd4e7c72d838fa0f14920

  • SHA1

    d6fdc27cf17555b26b34d3314868b229de8812bf

  • SHA256

    224574dfe9c295dfd6f4c1c078be410a05a2dac8ef368562a472a8fad9c3e23a

  • SHA512

    2841618eb6d89783122291fc759efdb49dfb56968237c8df4d713a52d485b7bb33e8f65db53b15f2e10f81e658dde2cd4eaa6b07f918852ade9d92aaa38d8203

  • SSDEEP

    12288:q7lw1DxepifX9IiyO9KWz3d7ysgfBnnl2bI:q7m1DX3yO9KWz3lysgpnnc8

Score
10/10
revengeratdiscoverystealertrojan

Malware Config

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat
  • Revengerat family
    revengerat
  • RevengeRat Executable 1 IoCs
    stealer
  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\224574dfe9c295dfd6f4c1c078be410a05a2dac8ef368562a472a8fad9c3e23aN.exe
    "C:\Users\Admin\AppData\Local\Temp\224574dfe9c295dfd6f4c1c078be410a05a2dac8ef368562a472a8fad9c3e23aN.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v7f.exe
      C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v7f.exe -install -54372629 -chipde -15706667e09f4a87ab0900d74d071b01 - -ChromeBundle -agprrzhexoebyjcn -197052
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1012

Network

  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    219.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    219.135.221.88.in-addr.arpa
    IN PTR
    Response
    219.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-219deploystaticakamaitechnologiescom
  • flag-us
    DNS
    73.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    245.231.24.184.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    245.231.24.184.in-addr.arpa
    IN PTR
    Response
    245.231.24.184.in-addr.arpa
    IN PTR
    a184-24-231-245deploystaticakamaitechnologiescom
  • flag-us
    DNS
    thinklabs-ltd.de
    ocs_v7f.exe
    Remote address:
    8.8.8.8:53
    Request
    thinklabs-ltd.de
    IN A
    Response
    thinklabs-ltd.de
    IN A
    176.9.175.237
  • flag-de
    GET
    http://thinklabs-ltd.de/geoip.php
    ocs_v7f.exe
    Remote address:
    176.9.175.237:80
    Request
    GET /geoip.php HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0; DSde) Gecko/20100101 Firefox/23.0
    Host: thinklabs-ltd.de
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Fri, 24 Jan 2025 02:28:46 GMT
    Server: Apache
    Vary: Accept-Encoding
    Content-Length: 2
    Keep-Alive: timeout=5, max=1500
    Connection: Keep-Alive
    Content-Type: text/html
  • flag-us
    DNS
    bin.download-sponsor.de
    ocs_v7f.exe
    Remote address:
    8.8.8.8:53
    Request
    bin.download-sponsor.de
    IN A
    Response
    bin.download-sponsor.de
    IN A
    176.9.175.234
  • flag-us
    DNS
    237.175.9.176.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.175.9.176.in-addr.arpa
    IN PTR
    Response
    237.175.9.176.in-addr.arpa
    IN PTR
    www1thinklabs-clusterde
  • flag-us
    DNS
    234.175.9.176.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    234.175.9.176.in-addr.arpa
    IN PTR
    Response
    234.175.9.176.in-addr.arpa
    IN PTR
    web1thinklabs-clusterde
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    114.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    114.134.221.88.in-addr.arpa
    IN PTR
    Response
    114.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-114deploystaticakamaitechnologiescom
  • flag-us
    DNS
    114.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    114.134.221.88.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
  • 176.9.175.237:80
    http://thinklabs-ltd.de/geoip.php
    http
    ocs_v7f.exe
    397 B
     330 B
     5
    3

    HTTP Request

    GET http://thinklabs-ltd.de/geoip.php

    HTTP Response

    200
  • 176.9.175.234:443
    bin.download-sponsor.de
    https
    ocs_v7f.exe
    543 B
     172 B
     7
    4
  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    219.135.221.88.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    219.135.221.88.in-addr.arpa

  • 8.8.8.8:53
    73.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    73.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    245.231.24.184.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    245.231.24.184.in-addr.arpa

  • 8.8.8.8:53
    thinklabs-ltd.de
    dns
    ocs_v7f.exe
    62 B
     78 B
     1
    1

    DNS Request

    thinklabs-ltd.de

    DNS Response

    176.9.175.237

  • 8.8.8.8:53
    bin.download-sponsor.de
    dns
    ocs_v7f.exe
    69 B
     85 B
     1
    1

    DNS Request

    bin.download-sponsor.de

    DNS Response

    176.9.175.234

  • 8.8.8.8:53
    237.175.9.176.in-addr.arpa
    dns
    72 B
     111 B
     1
    1

    DNS Request

    237.175.9.176.in-addr.arpa

  • 8.8.8.8:53
    234.175.9.176.in-addr.arpa
    dns
    72 B
     111 B
     1
    1

    DNS Request

    234.175.9.176.in-addr.arpa

  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    56.163.245.4.in-addr.arpa
    dns
    142 B
     157 B
     2
    1

    DNS Request

    56.163.245.4.in-addr.arpa

    DNS Request

    56.163.245.4.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    114.134.221.88.in-addr.arpa
    dns
    146 B
     139 B
     2
    1

    DNS Request

    114.134.221.88.in-addr.arpa

    DNS Request

    114.134.221.88.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    19.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\OCS\agprrzhexoebyjcn.dat
    Filesize

    83B

    MD5

    9246d9efdff3cca452eb00ee4ac89a0f

    SHA1

    ddfa7621f431042e737493488ebcd462646626ab

    SHA256

    f0c75c3d567c8763f2c449f590e7d4bef6a47924d3fd7622bf48b75108bbd4aa

    SHA512

    c20f715f376c7d0daecbebde91033ad4529006fd939e8c6311f9aea1dd162acedc08110d210d21db6a96af63ad32774d722646fa763eab2b63970e35176df54f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v7f.exe
    Filesize

    288KB

    MD5

    ea3ccd42dbdc3500e3888daf53d8ef5d

    SHA1

    848c686280eaa04b172fccffbd312132a0c46172

    SHA256

    cd166eede0e0e5303fc3f5fe5f0dd44999020f116bde2adea15319cc214751b5

    SHA512

    7126ec10c2301354f32f3f813958c61eaef63fe946b804ebd6f5934068b344ab75857886d867373f7a2ccf47f18a5a0f1dbe652e9649963a9fdea2b3de6dba50

    Download Submit

  • memory/1012-14-0x0000000001420000-0x0000000001428000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1012-16-0x00007FFDEF270000-0x00007FFDEFC11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1012-11-0x000000001BC10000-0x000000001BCB6000-memory.dmp

    Filesize

    664KB

    Download

  • memory/1012-12-0x000000001C770000-0x000000001C80C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/1012-13-0x00007FFDEF270000-0x00007FFDEFC11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1012-9-0x000000001C200000-0x000000001C6CE000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1012-8-0x00007FFDEF525000-0x00007FFDEF526000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1012-10-0x00007FFDEF270000-0x00007FFDEFC11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1012-17-0x00007FFDEF270000-0x00007FFDEFC11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1012-18-0x00007FFDEF270000-0x00007FFDEFC11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1012-19-0x00007FFDEF270000-0x00007FFDEFC11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1012-20-0x00007FFDEF270000-0x00007FFDEFC11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1012-21-0x00007FFDEF525000-0x00007FFDEF526000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1012-22-0x00007FFDEF270000-0x00007FFDEFC11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1012-23-0x00007FFDEF270000-0x00007FFDEFC11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1012-25-0x00007FFDEF270000-0x00007FFDEFC11000-memory.dmp

    Filesize

    9.6MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.