revengerat | 18387587b700bed7b5057652d9b6a6e73e96810ebb888fb5faaaae88016e1e53

Analysis

max time kernel
136s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13ff0d4226f02c4b0aea3c2a5dc83b68_JaffaCakes118.exe
Size

604KB
MD5

13ff0d4226f02c4b0aea3c2a5dc83b68
SHA1

91548398523e6dd4ebfab8317c517cfaca3571c9
SHA256

18387587b700bed7b5057652d9b6a6e73e96810ebb888fb5faaaae88016e1e53
SHA512

4abaf2b362ca640af0c56c152cbb5da91cbc30e07adaee6bd1101b92ff33b87bf3276f092fb7aa5b16ab85f36044100b56fcb126d5a46d95519839752651d6fc
SSDEEP

6144:SKWlw1DxX2p9fCEc2PI4Saq9JNl6zBY4o83fqysVufBn597NX2iL:S7lw1Dxmp9fXHPIz3vtysgfBnnl2iL

Score

10^/10

revengerat stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral2/files/0x000a000000023b9e-7.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
3472	ocs_v71.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3472	ocs_v71.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4456	13ff0d4226f02c4b0aea3c2a5dc83b68_JaffaCakes118.exe
3472	ocs_v71.exe
3472	ocs_v71.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 3472	4456	13ff0d4226f02c4b0aea3c2a5dc83b68_JaffaCakes118.exe	84
PID 4456 wrote to memory of 3472	4456	13ff0d4226f02c4b0aea3c2a5dc83b68_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\13ff0d4226f02c4b0aea3c2a5dc83b68_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\13ff0d4226f02c4b0aea3c2a5dc83b68_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe
  C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe -install -54403718 -chipde -75ff8d51a3a849ee94a49d46cb1e0c64 - -ChromeBundle -mteroulywqziboct -458896
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OCS\mteroulywqziboct.dat

Filesize
83B

MD5
c7cbdcad5c60785e72bc54eb8c07966f

SHA1
edc2e2b0f532cecdbec5d5fe336c18cd91dab9b1

SHA256
df0608eb72412182d52fd2103144aa0e5597630308f6568e16683cf5d7ae2767

SHA512
6f6870c7f3609c90f3911b793f855a75f5877f4d1128653869ec2ded879d66cf0cd4bcc237a6d36976a87d7af9cd72d7ee85612398166da15c3df55dc1cb5d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe

Filesize
292KB

MD5
ad68076fb58a634cba05c9396b0f20af

SHA1
dabc08bdf0203f5946101a0eea51d494e87f67b9

SHA256
dc712ebab17c0bf8d73a1c5b5b3b053fd1e665a2d6ad21eb5a9b34da6e844a5a

SHA512
be7f294cd4835353ab121a2de655f4a99718096f078713bd1bc8c2d2a847937bafe6853b13bb7c41178f1b33aeacf3af3d13b80f1494cca4489472458a1b63ba

Download Submit
memory/3472-13-0x00007FFECA860000-0x00007FFECB201000-memory.dmp

Filesize
9.6MB

Download
memory/3472-11-0x000000001BCF0000-0x000000001BD96000-memory.dmp

Filesize
664KB

Download
memory/3472-9-0x00007FFECA860000-0x00007FFECB201000-memory.dmp

Filesize
9.6MB

Download
memory/3472-12-0x000000001BDA0000-0x000000001BE3C000-memory.dmp

Filesize
624KB

Download
memory/3472-10-0x000000001B820000-0x000000001BCEE000-memory.dmp

Filesize
4.8MB

Download
memory/3472-14-0x0000000000DA0000-0x0000000000DA8000-memory.dmp

Filesize
32KB

Download
memory/3472-8-0x00007FFECAB15000-0x00007FFECAB16000-memory.dmp

Filesize
4KB

Download
memory/3472-16-0x00007FFECA860000-0x00007FFECB201000-memory.dmp

Filesize
9.6MB

Download
memory/3472-17-0x00007FFECA860000-0x00007FFECB201000-memory.dmp

Filesize
9.6MB

Download
memory/3472-18-0x00007FFECA860000-0x00007FFECB201000-memory.dmp

Filesize
9.6MB

Download
memory/3472-19-0x00007FFECA860000-0x00007FFECB201000-memory.dmp

Filesize
9.6MB

Download
memory/3472-21-0x00007FFECA860000-0x00007FFECB201000-memory.dmp

Filesize
9.6MB

Download