revengerat | 04968cab4ce01d1af9dfd1d61ec79e313e4428d22e2e5bbe3a260f7eaa0d1cc9

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a9df8e431df8520f13605e8a3726d7b_JaffaCakes118.exe
Size

604KB
MD5

9a9df8e431df8520f13605e8a3726d7b
SHA1

2337abded84366be4a06909dc142bda698f8b76e
SHA256

04968cab4ce01d1af9dfd1d61ec79e313e4428d22e2e5bbe3a260f7eaa0d1cc9
SHA512

3984fe881d4a7fab6038b859740542020748e0a363ce3f430ca3e37d3207a42a8851e2224af7ae789d28aa05d3a44dfb1f6569287812e4f421ce95e540122034
SSDEEP

6144:7KWlw1DxXyp9fCEc2PI4Saq9JNl6zBY4o83fqysVufBn597NX2Qn:77lw1DxCp9fXHPIz3vtysgfBnnl2Qn

Score

10^/10

revengerat stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0007000000014539-5.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
2352	ocs_v71.exe

Loads dropped DLL 2 IoCs

pid	Process
2284	9a9df8e431df8520f13605e8a3726d7b_JaffaCakes118.exe
2284	9a9df8e431df8520f13605e8a3726d7b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2284	9a9df8e431df8520f13605e8a3726d7b_JaffaCakes118.exe
2352	ocs_v71.exe
2352	ocs_v71.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2352	2284	9a9df8e431df8520f13605e8a3726d7b_JaffaCakes118.exe	28
PID 2284 wrote to memory of 2352	2284	9a9df8e431df8520f13605e8a3726d7b_JaffaCakes118.exe	28
PID 2284 wrote to memory of 2352	2284	9a9df8e431df8520f13605e8a3726d7b_JaffaCakes118.exe	28
PID 2284 wrote to memory of 2352	2284	9a9df8e431df8520f13605e8a3726d7b_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\9a9df8e431df8520f13605e8a3726d7b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9a9df8e431df8520f13605e8a3726d7b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe
  C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe -install -54403718 -chipde -61cdb4dad7ac454f97ec807a55498c3e - -ChromeBundle -knnwgrxfxzpqjofb -524568
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OCS\knnwgrxfxzpqjofb.dat

Filesize
83B

MD5
e6fac656768c450baf7c0634bb4aa1b9

SHA1
8cd9ce9f64acf0eaaac667217f57d3cbb345d2ea

SHA256
2e6a11dc4eccdedbd87956f15d2a4ce62ce363266d7f12f8fed1a5d316120970

SHA512
11143a4b73a23482708c07841a1bcc651471e036b0e9161e165cc0479d79048c814afc820fc69c61294e3856e9918285328414d70b7792130b945cbb4a05479b

Download Submit
\Users\Admin\AppData\Local\Temp\OCS\ocs_v71.exe

Filesize
292KB

MD5
ad68076fb58a634cba05c9396b0f20af

SHA1
dabc08bdf0203f5946101a0eea51d494e87f67b9

SHA256
dc712ebab17c0bf8d73a1c5b5b3b053fd1e665a2d6ad21eb5a9b34da6e844a5a

SHA512
be7f294cd4835353ab121a2de655f4a99718096f078713bd1bc8c2d2a847937bafe6853b13bb7c41178f1b33aeacf3af3d13b80f1494cca4489472458a1b63ba

Download Submit
memory/2352-12-0x000007FEF627E000-0x000007FEF627F000-memory.dmp

Filesize
4KB

Download
memory/2352-13-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmp

Filesize
9.6MB

Download
memory/2352-15-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmp

Filesize
9.6MB

Download
memory/2352-16-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmp

Filesize
9.6MB

Download
memory/2352-17-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmp

Filesize
9.6MB

Download
memory/2352-18-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmp

Filesize
9.6MB

Download
memory/2352-19-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmp

Filesize
9.6MB

Download
memory/2352-20-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmp

Filesize
9.6MB

Download
memory/2352-21-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads