revengerat | 18387587b700bed7b5057652d9b6a6e73e96810ebb888fb5faaaae88016e1e53

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13ff0d4226f02c4b0aea3c2a5dc83b68_JaffaCakes118.exe
Size

604KB
MD5

13ff0d4226f02c4b0aea3c2a5dc83b68
SHA1

91548398523e6dd4ebfab8317c517cfaca3571c9
SHA256

18387587b700bed7b5057652d9b6a6e73e96810ebb888fb5faaaae88016e1e53
SHA512

4abaf2b362ca640af0c56c152cbb5da91cbc30e07adaee6bd1101b92ff33b87bf3276f092fb7aa5b16ab85f36044100b56fcb126d5a46d95519839752651d6fc
SSDEEP

6144:SKWlw1DxX2p9fCEc2PI4Saq9JNl6zBY4o83fqysVufBn597NX2iL:S7lw1Dxmp9fXHPIz3vtysgfBnnl2iL

Score

10^/10

revengerat stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0007000000014b27-11.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
2060	ocs_v71.exe

Loads dropped DLL 2 IoCs

pid	Process
2232	13ff0d4226f02c4b0aea3c2a5dc83b68_JaffaCakes118.exe
2232	13ff0d4226f02c4b0aea3c2a5dc83b68_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2232	13ff0d4226f02c4b0aea3c2a5dc83b68_JaffaCakes118.exe
2060	ocs_v71.exe
2060	ocs_v71.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2060	2232	13ff0d4226f02c4b0aea3c2a5dc83b68_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2060	2232	13ff0d4226f02c4b0aea3c2a5dc83b68_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2060	2232	13ff0d4226f02c4b0aea3c2a5dc83b68_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2060	2232	13ff0d4226f02c4b0aea3c2a5dc83b68_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\13ff0d4226f02c4b0aea3c2a5dc83b68_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\13ff0d4226f02c4b0aea3c2a5dc83b68_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe
  C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe -install -54403718 -chipde -75ff8d51a3a849ee94a49d46cb1e0c64 - -ChromeBundle -ohhfgumzjkyukzht -524568
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe

Filesize
292KB

MD5
ad68076fb58a634cba05c9396b0f20af

SHA1
dabc08bdf0203f5946101a0eea51d494e87f67b9

SHA256
dc712ebab17c0bf8d73a1c5b5b3b053fd1e665a2d6ad21eb5a9b34da6e844a5a

SHA512
be7f294cd4835353ab121a2de655f4a99718096f078713bd1bc8c2d2a847937bafe6853b13bb7c41178f1b33aeacf3af3d13b80f1494cca4489472458a1b63ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\OCS\ohhfgumzjkyukzht.dat

Filesize
83B

MD5
c7cbdcad5c60785e72bc54eb8c07966f

SHA1
edc2e2b0f532cecdbec5d5fe336c18cd91dab9b1

SHA256
df0608eb72412182d52fd2103144aa0e5597630308f6568e16683cf5d7ae2767

SHA512
6f6870c7f3609c90f3911b793f855a75f5877f4d1128653869ec2ded879d66cf0cd4bcc237a6d36976a87d7af9cd72d7ee85612398166da15c3df55dc1cb5d24

Download Submit
memory/2060-12-0x000007FEF5D3E000-0x000007FEF5D3F000-memory.dmp

Filesize
4KB

Download
memory/2060-14-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

Filesize
9.6MB

Download
memory/2060-15-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

Filesize
9.6MB

Download
memory/2060-16-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

Filesize
9.6MB

Download
memory/2060-17-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

Filesize
9.6MB

Download
memory/2060-18-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

Filesize
9.6MB

Download
memory/2060-19-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

Filesize
9.6MB

Download
memory/2060-20-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads