revengerat | 138b2c5fced07fa0ccb4134f4eb12215fa752278f6a38fdb6e60a14e7404e769

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d7327ac849017db4ba0e6f92b07dae0_JaffaCakes118.exe
Size

604KB
MD5

6d7327ac849017db4ba0e6f92b07dae0
SHA1

f284b332bb2fb231ce4ec6ef9c995b852fed219f
SHA256

138b2c5fced07fa0ccb4134f4eb12215fa752278f6a38fdb6e60a14e7404e769
SHA512

f12bb044b69f86903868ef59f2614c984c354037178055e7c6c99fdd5949fb5d025667faae3f224b98e5cc44426435120cf1409d6a76dd780a6f46ed7f7407d7
SSDEEP

6144:FKWlw1DxXop9fCEc2PI4Saq9JNl6zBY4o83fqysVufBn597NX24w:F7lw1Dx4p9fXHPIz3vtysgfBnnl24w

Score

10^/10

revengerat stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0007000000014dae-5.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
1748	ocs_v71.exe

Loads dropped DLL 2 IoCs

pid	Process
1280	6d7327ac849017db4ba0e6f92b07dae0_JaffaCakes118.exe
1280	6d7327ac849017db4ba0e6f92b07dae0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1280	6d7327ac849017db4ba0e6f92b07dae0_JaffaCakes118.exe
1748	ocs_v71.exe
1748	ocs_v71.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 1748	1280	6d7327ac849017db4ba0e6f92b07dae0_JaffaCakes118.exe	28
PID 1280 wrote to memory of 1748	1280	6d7327ac849017db4ba0e6f92b07dae0_JaffaCakes118.exe	28
PID 1280 wrote to memory of 1748	1280	6d7327ac849017db4ba0e6f92b07dae0_JaffaCakes118.exe	28
PID 1280 wrote to memory of 1748	1280	6d7327ac849017db4ba0e6f92b07dae0_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\6d7327ac849017db4ba0e6f92b07dae0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6d7327ac849017db4ba0e6f92b07dae0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe
  C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe -install -54384361 -chipde -a848d88d9d29467daf54e30ddd694c94 - -ChromeBundle -tzqyztzdwdfsorpo -524568
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OCS\tzqyztzdwdfsorpo.dat

Filesize
83B

MD5
7c2239e45351d3a88606a47b475818e3

SHA1
e22f2d9e2357409b39cc4bd8371c474f5df3d629

SHA256
ba8c2502f995751ac66bba271561790f15c9882cc46eb40cde193aeb1885d5b1

SHA512
c82fc3a67f9169927a585a00c1b47505be18a6fe89285ede56c0e34a3f17963258c4d4d3c554dc08015ae863182414258605e629d5268bb887b2e51ca2a12a90

Download Submit
\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe

Filesize
292KB

MD5
ad68076fb58a634cba05c9396b0f20af

SHA1
dabc08bdf0203f5946101a0eea51d494e87f67b9

SHA256
dc712ebab17c0bf8d73a1c5b5b3b053fd1e665a2d6ad21eb5a9b34da6e844a5a

SHA512
be7f294cd4835353ab121a2de655f4a99718096f078713bd1bc8c2d2a847937bafe6853b13bb7c41178f1b33aeacf3af3d13b80f1494cca4489472458a1b63ba

Download Submit
memory/1748-12-0x000007FEF558E000-0x000007FEF558F000-memory.dmp

Filesize
4KB

Download
memory/1748-13-0x000007FEF52D0000-0x000007FEF5C6D000-memory.dmp

Filesize
9.6MB

Download
memory/1748-15-0x000007FEF52D0000-0x000007FEF5C6D000-memory.dmp

Filesize
9.6MB

Download
memory/1748-16-0x000007FEF52D0000-0x000007FEF5C6D000-memory.dmp

Filesize
9.6MB

Download
memory/1748-17-0x000007FEF52D0000-0x000007FEF5C6D000-memory.dmp

Filesize
9.6MB

Download
memory/1748-18-0x000007FEF52D0000-0x000007FEF5C6D000-memory.dmp

Filesize
9.6MB

Download
memory/1748-19-0x000007FEF52D0000-0x000007FEF5C6D000-memory.dmp

Filesize
9.6MB

Download
memory/1748-20-0x000007FEF52D0000-0x000007FEF5C6D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads