Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

1dc08569d3...fN.exe

windows7-x64

10

1dc08569d3...fN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2025, 11:21 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1dc08569d3a1f7df0c9924010b116d67cf2bf1fcbec1891495eb5698ef6319ffN.exe

  • Size

    598KB

  • MD5

    7a03ef6e44b61c2e00c53dfa1c69ceb0

  • SHA1

    98b6a9cfbbddbce18e936c62a887cf78f80c46ae

  • SHA256

    1dc08569d3a1f7df0c9924010b116d67cf2bf1fcbec1891495eb5698ef6319ff

  • SHA512

    008633cf1a3b7119d94551e6ffc0ab283a3f28b53427298f26971860cd425cc851a35e1d21ca8bcafdb3bfde468b88626f2edf5d232ecd2b5fd33605f4d95859

  • SSDEEP

    6144:TKWlw1DxD+ASIAfCEv2YUMNJlaJuNlK17Y4c83fhysVufBn597NX2X:T7lw1Dxq5zfXeYU43fiysgfBnnl2X

Score
10/10
revengeratdiscoverystealertrojan

Malware Config

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat
  • Revengerat family
    revengerat
  • RevengeRat Executable 1 IoCs
    stealer
  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1dc08569d3a1f7df0c9924010b116d67cf2bf1fcbec1891495eb5698ef6319ffN.exe
    "C:\Users\Admin\AppData\Local\Temp\1dc08569d3a1f7df0c9924010b116d67cf2bf1fcbec1891495eb5698ef6319ffN.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4256
    • C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe
      C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe -install -54423242 -chipde -4d7b1e0d39df4fa99204ca0c313fd41f - -BLUB1 -xxqrkrrqsmiqabke -327824
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1468

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    0.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    184.115.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    184.115.23.2.in-addr.arpa
    IN PTR
    Response
    184.115.23.2.in-addr.arpa
    IN PTR
    a2-23-115-184deploystaticakamaitechnologiescom
  • flag-us
    DNS
    thinklabs-ltd.de
    ocs_v71a.exe
    Remote address:
    8.8.8.8:53
    Request
    thinklabs-ltd.de
    IN A
    Response
    thinklabs-ltd.de
    IN A
    176.9.175.237
  • flag-de
    GET
    http://thinklabs-ltd.de/geoip.php
    ocs_v71a.exe
    Remote address:
    176.9.175.237:80
    Request
    GET /geoip.php HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0; DSde) Gecko/20100101 Firefox/23.0
    Host: thinklabs-ltd.de
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Fri, 24 Jan 2025 11:21:28 GMT
    Server: Apache
    Vary: Accept-Encoding
    Content-Length: 2
    Keep-Alive: timeout=5, max=1500
    Connection: Keep-Alive
    Content-Type: text/html
  • flag-us
    DNS
    bin.download-sponsor.de
    ocs_v71a.exe
    Remote address:
    8.8.8.8:53
    Request
    bin.download-sponsor.de
    IN A
    Response
    bin.download-sponsor.de
    IN A
    176.9.175.234
  • flag-us
    DNS
    237.175.9.176.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.175.9.176.in-addr.arpa
    IN PTR
    Response
    237.175.9.176.in-addr.arpa
    IN PTR
    www1thinklabs-clusterde
  • flag-us
    DNS
    234.175.9.176.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    234.175.9.176.in-addr.arpa
    IN PTR
    Response
    234.175.9.176.in-addr.arpa
    IN PTR
    web1thinklabs-clusterde
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    212.20.149.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    212.20.149.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    24.139.73.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    24.139.73.23.in-addr.arpa
    IN PTR
    Response
    24.139.73.23.in-addr.arpa
    IN PTR
    a23-73-139-24deploystaticakamaitechnologiescom
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • 176.9.175.237:80
    http://thinklabs-ltd.de/geoip.php
    http
    ocs_v71a.exe
    397 B
     330 B
     5
    3

    HTTP Request

    GET http://thinklabs-ltd.de/geoip.php

    HTTP Response

    200
  • 176.9.175.234:443
    bin.download-sponsor.de
    https
    ocs_v71a.exe
    443 B
     172 B
     5
    4
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    0.159.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    0.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    184.115.23.2.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    184.115.23.2.in-addr.arpa

  • 8.8.8.8:53
    thinklabs-ltd.de
    dns
    ocs_v71a.exe
    62 B
     78 B
     1
    1

    DNS Request

    thinklabs-ltd.de

    DNS Response

    176.9.175.237

  • 8.8.8.8:53
    bin.download-sponsor.de
    dns
    ocs_v71a.exe
    69 B
     85 B
     1
    1

    DNS Request

    bin.download-sponsor.de

    DNS Response

    176.9.175.234

  • 8.8.8.8:53
    237.175.9.176.in-addr.arpa
    dns
    72 B
     111 B
     1
    1

    DNS Request

    237.175.9.176.in-addr.arpa

  • 8.8.8.8:53
    234.175.9.176.in-addr.arpa
    dns
    72 B
     111 B
     1
    1

    DNS Request

    234.175.9.176.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    212.20.149.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    212.20.149.52.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    24.139.73.23.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    24.139.73.23.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe
    Filesize

    288KB

    MD5

    317ec5f92cfbf04a53e8125b66b3b4af

    SHA1

    16068b8977b4dc562ae782d91bc009472667e331

    SHA256

    7612ef3877c3e4e305a6c22941141601b489a73bc088622a40ebd93bee25bae5

    SHA512

    ed772da641a5c128677c4c285c648c1d8e539c34522b95c14f614797bb0d188571c7c257441d45598809aa3f8b4690bd53230282726e077c86c8d9fe71c1db65

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\OCS\xxqrkrrqsmiqabke.dat
    Filesize

    81B

    MD5

    8e880c367c5a2eb9cdf6c8db1007a15f

    SHA1

    72c7253ae133aaa0b9e4946a68664da10422fbe2

    SHA256

    60fddb9d2f345bc99bddf7883b1036cbde19a115c6593f2d16dfb6c1a686cc5e

    SHA512

    5dafbf0cc0ec6e683d73ebe91470d22eed6b5d441ae96f1d23d2ec80c567f580bf7aaa958e78f755daca7a24997d41e9fdabab8711ced6ef1383ff28c6062a68

    Download Submit

  • memory/1468-11-0x000000001BE90000-0x000000001BF36000-memory.dmp

    Filesize

    664KB

    Download

  • memory/1468-18-0x00007FFFD2700000-0x00007FFFD30A1000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1468-10-0x000000001C4B0000-0x000000001C97E000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1468-12-0x000000001CA20000-0x000000001CABC000-memory.dmp

    Filesize

    624KB

    Download

  • memory/1468-13-0x00007FFFD2700000-0x00007FFFD30A1000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1468-14-0x0000000001A90000-0x0000000001A98000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1468-8-0x00007FFFD29B5000-0x00007FFFD29B6000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1468-16-0x00007FFFD2700000-0x00007FFFD30A1000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1468-17-0x00007FFFD2700000-0x00007FFFD30A1000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1468-9-0x00007FFFD2700000-0x00007FFFD30A1000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1468-19-0x00007FFFD2700000-0x00007FFFD30A1000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1468-20-0x00007FFFD2700000-0x00007FFFD30A1000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1468-21-0x00007FFFD2700000-0x00007FFFD30A1000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1468-22-0x00007FFFD29B5000-0x00007FFFD29B6000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1468-23-0x00007FFFD2700000-0x00007FFFD30A1000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1468-24-0x00007FFFD2700000-0x00007FFFD30A1000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1468-26-0x00007FFFD2700000-0x00007FFFD30A1000-memory.dmp

    Filesize

    9.6MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.