revengerat | 0564a9ac98d0861ea3a78ff19059501807d3d8a8702e69b5173d3d560228e412

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34562de41c50d9f0855fd0759a9a80d0_JaffaCakes118.exe
Size

604KB
MD5

34562de41c50d9f0855fd0759a9a80d0
SHA1

e110ea659476d130635556e82ce6a42d4e9e36b9
SHA256

0564a9ac98d0861ea3a78ff19059501807d3d8a8702e69b5173d3d560228e412
SHA512

1d5d84c3e82243ae3f519430e6b3014adb9a267fd3cd6515f2cc051a594e7f1822e95bb8027b867990e6dee09382eb95d01622451720a98a977cb1788051b0d4
SSDEEP

6144:oKWlw1DxXhp9fCEc2PI4Saq9JNl6zBY4o83fqysVufBn597NX2X5:o7lw1DxRp9fXHPIz3vtysgfBnnl2X5

Score

10^/10

revengerat stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0007000000015c2f-5.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
2552	ocs_v71.exe

Loads dropped DLL 2 IoCs

pid	Process
3024	34562de41c50d9f0855fd0759a9a80d0_JaffaCakes118.exe
3024	34562de41c50d9f0855fd0759a9a80d0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3024	34562de41c50d9f0855fd0759a9a80d0_JaffaCakes118.exe
2552	ocs_v71.exe
2552	ocs_v71.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2552	3024	34562de41c50d9f0855fd0759a9a80d0_JaffaCakes118.exe	28
PID 3024 wrote to memory of 2552	3024	34562de41c50d9f0855fd0759a9a80d0_JaffaCakes118.exe	28
PID 3024 wrote to memory of 2552	3024	34562de41c50d9f0855fd0759a9a80d0_JaffaCakes118.exe	28
PID 3024 wrote to memory of 2552	3024	34562de41c50d9f0855fd0759a9a80d0_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\34562de41c50d9f0855fd0759a9a80d0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\34562de41c50d9f0855fd0759a9a80d0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe
  C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe -install -54474105 -chipde -49b01ee1e35d46e69abbaad3c82bf209 - -ChromeBundle -flrnbcchzbhsxwte -328012
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OCS\flrnbcchzbhsxwte.dat

Filesize
83B

MD5
17df3e88660d58d1c4242cd8e22ef363

SHA1
24ee0010c82f25ff74e63689c52ec7b74bb92383

SHA256
460ad07a370655652ed1c6bd491d127d8a1fbec0bffddbc54e2fc6ddb48d6100

SHA512
b8a479fbc7a4b98cfee82b2be6e1226cdf7cbab8b8b2e11a21c8ac7662f8cddb74312e5af212ba863ef31227ce7ed7f7f451aeed35c68ef7455bed9d2bf1e4ed

Download Submit
\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe

Filesize
292KB

MD5
ad68076fb58a634cba05c9396b0f20af

SHA1
dabc08bdf0203f5946101a0eea51d494e87f67b9

SHA256
dc712ebab17c0bf8d73a1c5b5b3b053fd1e665a2d6ad21eb5a9b34da6e844a5a

SHA512
be7f294cd4835353ab121a2de655f4a99718096f078713bd1bc8c2d2a847937bafe6853b13bb7c41178f1b33aeacf3af3d13b80f1494cca4489472458a1b63ba

Download Submit
memory/2552-12-0x000007FEF60AE000-0x000007FEF60AF000-memory.dmp

Filesize
4KB

Download
memory/2552-13-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2552-15-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2552-16-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2552-17-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2552-18-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2552-19-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2552-20-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2552-21-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download
memory/2552-22-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads