Analysis
- max time kernel
92s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
- submitted
09/07/2024, 08:32
General
- Target 2fa8ed75ed8fadfd28d2cc67c5b9c41b_JaffaCakes118.exe
- Size 496KB
- Sample240709-kfsc6avdpn
- SHA256 0bdd148bb9fe4e2ad5c04fd94254bb3b6595311cfe19943db1c540e690442528
Malware Config
Signatures
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- RevengeRat Executable 1 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fa8ed75ed8fadfd28d2cc67c5b9c41b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2fa8ed75ed8fadfd28d2cc67c5b9c41b_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v5c.exeC:\Users\Admin\AppData\Local\Temp\OCS\ocs_v5c.exe -install -m361219 -freewarede -4447c4f2a59a4576820414cc2e1cebfd - -2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
ocs_v5c.exe
memory/3052-7-0x00007FFADA7A5000-0x00007FFADA7A6000-memory.dmp
memory/3052-8-0x000000001B7B0000-0x000000001BC7E000-memory.dmp
memory/3052-9-0x000000001BD30000-0x000000001BDD6000-memory.dmp
memory/3052-10-0x00007FFADA4F0000-0x00007FFADAE91000-memory.dmp
memory/3052-11-0x000000001BEF0000-0x000000001BF8C000-memory.dmp
memory/3052-12-0x00007FFADA4F0000-0x00007FFADAE91000-memory.dmp
memory/3052-13-0x000000001BDF0000-0x000000001BDF8000-memory.dmp
memory/3052-14-0x00007FFADA4F0000-0x00007FFADAE91000-memory.dmp
memory/3052-15-0x00007FFADA4F0000-0x00007FFADAE91000-memory.dmp
memory/3052-16-0x00007FFADA4F0000-0x00007FFADAE91000-memory.dmp
memory/3052-17-0x00007FFADA4F0000-0x00007FFADAE91000-memory.dmp
memory/3052-18-0x00007FFADA4F0000-0x00007FFADAE91000-memory.dmp
memory/3052-19-0x00007FFADA4F0000-0x00007FFADAE91000-memory.dmp
memory/3052-21-0x00007FFADA4F0000-0x00007FFADAE91000-memory.dmp