revengerat | 138b2c5fced07fa0ccb4134f4eb12215fa752278f6a38fdb6e60a14e7404e769

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d7327ac849017db4ba0e6f92b07dae0_JaffaCakes118.exe
Size

604KB
MD5

6d7327ac849017db4ba0e6f92b07dae0
SHA1

f284b332bb2fb231ce4ec6ef9c995b852fed219f
SHA256

138b2c5fced07fa0ccb4134f4eb12215fa752278f6a38fdb6e60a14e7404e769
SHA512

f12bb044b69f86903868ef59f2614c984c354037178055e7c6c99fdd5949fb5d025667faae3f224b98e5cc44426435120cf1409d6a76dd780a6f46ed7f7407d7
SSDEEP

6144:FKWlw1DxXop9fCEc2PI4Saq9JNl6zBY4o83fqysVufBn597NX24w:F7lw1Dx4p9fXHPIz3vtysgfBnnl24w

Score

10^/10

revengerat stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral2/files/0x000700000002340b-6.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
916	ocs_v71.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	ocs_v71.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4912	6d7327ac849017db4ba0e6f92b07dae0_JaffaCakes118.exe
916	ocs_v71.exe
916	ocs_v71.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 916	4912	6d7327ac849017db4ba0e6f92b07dae0_JaffaCakes118.exe	82
PID 4912 wrote to memory of 916	4912	6d7327ac849017db4ba0e6f92b07dae0_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\6d7327ac849017db4ba0e6f92b07dae0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6d7327ac849017db4ba0e6f92b07dae0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe
  C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe -install -54384361 -chipde -a848d88d9d29467daf54e30ddd694c94 - -ChromeBundle -hbzbdxyfwljwezpa -393602
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OCS\hbzbdxyfwljwezpa.dat

Filesize
83B

MD5
7c2239e45351d3a88606a47b475818e3

SHA1
e22f2d9e2357409b39cc4bd8371c474f5df3d629

SHA256
ba8c2502f995751ac66bba271561790f15c9882cc46eb40cde193aeb1885d5b1

SHA512
c82fc3a67f9169927a585a00c1b47505be18a6fe89285ede56c0e34a3f17963258c4d4d3c554dc08015ae863182414258605e629d5268bb887b2e51ca2a12a90

Download Submit
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe

Filesize
292KB

MD5
ad68076fb58a634cba05c9396b0f20af

SHA1
dabc08bdf0203f5946101a0eea51d494e87f67b9

SHA256
dc712ebab17c0bf8d73a1c5b5b3b053fd1e665a2d6ad21eb5a9b34da6e844a5a

SHA512
be7f294cd4835353ab121a2de655f4a99718096f078713bd1bc8c2d2a847937bafe6853b13bb7c41178f1b33aeacf3af3d13b80f1494cca4489472458a1b63ba

Download Submit
memory/916-13-0x0000000000AC0000-0x0000000000AC8000-memory.dmp

Filesize
32KB

Download
memory/916-10-0x000000001B740000-0x000000001BC0E000-memory.dmp

Filesize
4.8MB

Download
memory/916-11-0x000000001B160000-0x000000001B206000-memory.dmp

Filesize
664KB

Download
memory/916-12-0x000000001BCB0000-0x000000001BD4C000-memory.dmp

Filesize
624KB

Download
memory/916-9-0x00007FFA94C50000-0x00007FFA955F1000-memory.dmp

Filesize
9.6MB

Download
memory/916-15-0x00007FFA94C50000-0x00007FFA955F1000-memory.dmp

Filesize
9.6MB

Download
memory/916-8-0x00007FFA94F05000-0x00007FFA94F06000-memory.dmp

Filesize
4KB

Download
memory/916-16-0x00007FFA94C50000-0x00007FFA955F1000-memory.dmp

Filesize
9.6MB

Download
memory/916-17-0x00007FFA94C50000-0x00007FFA955F1000-memory.dmp

Filesize
9.6MB

Download
memory/916-18-0x00007FFA94C50000-0x00007FFA955F1000-memory.dmp

Filesize
9.6MB

Download
memory/916-19-0x00007FFA94C50000-0x00007FFA955F1000-memory.dmp

Filesize
9.6MB

Download
memory/916-21-0x00007FFA94C50000-0x00007FFA955F1000-memory.dmp

Filesize
9.6MB

Download