Analysis
- max time kernel
94s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
01/01/2025, 22:15
General
- Target JaffaCakes118_60f47edeadf7ad29af995f83d01cdd70.exe
- Size 598KB
- Sample250101-16d68azlem
- SHA256 51b70dd9cccd2ba85e006c35463890e4e10c69d384f999b3145d9fd1033b648b
Malware Config
Signatures
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- Revengerat family
- RevengeRat Executable 1 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_60f47edeadf7ad29af995f83d01cdd70.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_60f47edeadf7ad29af995f83d01cdd70.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exeC:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe -install -58118521 -chipde -a663e0868fe54544bac6efbfdecc5fe6 - -BLUB1 -ryjsohoyvykcjqxe -2622882⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ocs_v71a.exe
ryjsohoyvykcjqxe.dat
memory/3584-17-0x00007FF909250000-0x00007FF909BF1000-memory.dmp
memory/3584-18-0x00007FF909250000-0x00007FF909BF1000-memory.dmp
memory/3584-9-0x00007FF909250000-0x00007FF909BF1000-memory.dmp
memory/3584-12-0x000000001C0B0000-0x000000001C14C000-memory.dmp
memory/3584-13-0x00007FF909250000-0x00007FF909BF1000-memory.dmp
memory/3584-14-0x0000000001090000-0x0000000001098000-memory.dmp
memory/3584-10-0x000000001BA40000-0x000000001BF0E000-memory.dmp
memory/3584-16-0x00007FF909250000-0x00007FF909BF1000-memory.dmp
memory/3584-8-0x00007FF909505000-0x00007FF909506000-memory.dmp
memory/3584-11-0x000000001BF10000-0x000000001BFB6000-memory.dmp
memory/3584-19-0x00007FF909250000-0x00007FF909BF1000-memory.dmp
memory/3584-20-0x00007FF909250000-0x00007FF909BF1000-memory.dmp
memory/3584-21-0x00007FF909505000-0x00007FF909506000-memory.dmp
memory/3584-22-0x00007FF909250000-0x00007FF909BF1000-memory.dmp
memory/3584-23-0x00007FF909250000-0x00007FF909BF1000-memory.dmp
memory/3584-24-0x00007FF909250000-0x00007FF909BF1000-memory.dmp
memory/3584-25-0x00007FF909250000-0x00007FF909BF1000-memory.dmp
memory/3584-26-0x00007FF909250000-0x00007FF909BF1000-memory.dmp
memory/3584-28-0x00007FF909250000-0x00007FF909BF1000-memory.dmp