Analysis
- max time kernel
92s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
07/10/2024, 10:34
General
- Target 1cf62a27a2c8e2cbb12b5b49ddb83436_JaffaCakes118.exe
- Size 542KB
- Sample241007-ml4z9avajd
- SHA256 d448dd127cdf0a2ebbf5d0eb75a6c575d35ad9063b90f5954ef5d8920167d01d
Malware Config
Signatures
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- RevengeRat Executable 1 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cf62a27a2c8e2cbb12b5b49ddb83436_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1cf62a27a2c8e2cbb12b5b49ddb83436_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6w.exeC:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6w.exe -install -23218 -netzwelt -2a17c53a94f8440d8b2db25fdfe912ef - - -xnyggmgdobhtqaad2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ocs_v6w.exe
xnyggmgdobhtqaad.dat
memory/2864-15-0x00007FFE0C5B0000-0x00007FFE0CF51000-memory.dmp
memory/2864-18-0x00007FFE0C5B0000-0x00007FFE0CF51000-memory.dmp
memory/2864-11-0x000000001C7D0000-0x000000001C876000-memory.dmp
memory/2864-12-0x000000001C920000-0x000000001C9BC000-memory.dmp
memory/2864-10-0x000000001C300000-0x000000001C7CE000-memory.dmp
memory/2864-13-0x0000000001620000-0x0000000001628000-memory.dmp
memory/2864-8-0x00007FFE0C865000-0x00007FFE0C866000-memory.dmp
memory/2864-16-0x00007FFE0C5B0000-0x00007FFE0CF51000-memory.dmp
memory/2864-17-0x00007FFE0C5B0000-0x00007FFE0CF51000-memory.dmp
memory/2864-9-0x00007FFE0C5B0000-0x00007FFE0CF51000-memory.dmp
memory/2864-19-0x00007FFE0C5B0000-0x00007FFE0CF51000-memory.dmp
memory/2864-20-0x00007FFE0C5B0000-0x00007FFE0CF51000-memory.dmp
memory/2864-21-0x00007FFE0C5B0000-0x00007FFE0CF51000-memory.dmp
memory/2864-22-0x00007FFE0C5B0000-0x00007FFE0CF51000-memory.dmp
memory/2864-23-0x00007FFE0C865000-0x00007FFE0C866000-memory.dmp
memory/2864-24-0x00007FFE0C5B0000-0x00007FFE0CF51000-memory.dmp
memory/2864-26-0x00007FFE0C5B0000-0x00007FFE0CF51000-memory.dmp