Analysis
- max time kernel
97s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
14/05/2024, 20:05
General
- Target 42da02e6d3ae09cc2d428bb7967ab7bb_JaffaCakes118.exe
- Size 614KB
- Sample240514-yvbwlsef25
- SHA256 11b31f68b9814fdc512c0ddcffad6ea8c67231e18d0b8ed7924b7a525eb35ee8
Malware Config
Signatures
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- RevengeRat Executable 1 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\42da02e6d3ae09cc2d428bb7967ab7bb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\42da02e6d3ae09cc2d428bb7967ab7bb_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71b.exeC:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71b.exe -install -54383364 -chipde -42b9c4c64e7d4794a90fc3c73584afa8 - -BLUB2 -hflcurdsvcunmipq -5246702⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
hflcurdsvcunmipq.dat
ocs_v71b.exe
memory/4856-11-0x00007FFF9E880000-0x00007FFF9F221000-memory.dmp
memory/4856-16-0x00007FFF9E880000-0x00007FFF9F221000-memory.dmp
memory/4856-9-0x000000001C2D0000-0x000000001C79E000-memory.dmp
memory/4856-12-0x000000001C910000-0x000000001C9AC000-memory.dmp
memory/4856-13-0x00007FFF9E880000-0x00007FFF9F221000-memory.dmp
memory/4856-14-0x0000000001620000-0x0000000001628000-memory.dmp
memory/4856-8-0x00007FFF9EB35000-0x00007FFF9EB36000-memory.dmp
memory/4856-10-0x000000001C7A0000-0x000000001C846000-memory.dmp
memory/4856-17-0x00007FFF9E880000-0x00007FFF9F221000-memory.dmp
memory/4856-18-0x00007FFF9E880000-0x00007FFF9F221000-memory.dmp
memory/4856-19-0x00007FFF9E880000-0x00007FFF9F221000-memory.dmp
memory/4856-20-0x00007FFF9E880000-0x00007FFF9F221000-memory.dmp
memory/4856-21-0x00007FFF9E880000-0x00007FFF9F221000-memory.dmp
memory/4856-23-0x00007FFF9E880000-0x00007FFF9F221000-memory.dmp