Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01-01-2025 18:46

General

  • Target

    JaffaCakes118_60131dd6ad909ad90c27460247b0cda0.exe

  • Size

    598KB

  • MD5

    60131dd6ad909ad90c27460247b0cda0

  • SHA1

    d12568d8b2b25e9555112196f94bd0d620a227f1

  • SHA256

    7fbf15c4b99fc88a09c5c1ad464c078c38ca05d5a544724297e4c83997fe97b8

  • SHA512

    6b36596b648fea1f427649aa65311bfdf23c93af9939026edb17a8b3e4d572284bdb46fa796b0f2b00ad99d6ac7abf1b18ba74ba85f28baa803339bb18a73ae6

  • SSDEEP

    6144:zKWlw1DxDnASIAfCEv2YUMNJlaJuNlK17Y4c83fhysVufBn597NX2t:z7lw1DxD5zfXeYU43fiysgfBnnl2t

Malware Config

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Revengerat family
  • RevengeRat Executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_60131dd6ad909ad90c27460247b0cda0.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_60131dd6ad909ad90c27460247b0cda0.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe
      C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe -install -54443778 -chipde -12de7d2e43384486816ae9a1ff0e656b - -BLUB1 -erodllxihvdxajnt -459092
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2228

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\OCS\erodllxihvdxajnt.dat

    Filesize

    83B

    MD5

    c33cd56bee4aaa86e6102acffa19a862

    SHA1

    ec684e9ce7a42ef8866b32dace5f9ec6427e69ff

    SHA256

    69f26edf39f15ac00823503e652795d6d998e8da4303438dc6e76c7deb04f877

    SHA512

    6f239f1dda710371dc6a605634667feaad257199b3a2612d85be060d8119854b993fbc6c8950462b02460a35c6c7326a19bb6d79b0fb338bc094211124fd3ac3

  • \Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe

    Filesize

    288KB

    MD5

    317ec5f92cfbf04a53e8125b66b3b4af

    SHA1

    16068b8977b4dc562ae782d91bc009472667e331

    SHA256

    7612ef3877c3e4e305a6c22941141601b489a73bc088622a40ebd93bee25bae5

    SHA512

    ed772da641a5c128677c4c285c648c1d8e539c34522b95c14f614797bb0d188571c7c257441d45598809aa3f8b4690bd53230282726e077c86c8d9fe71c1db65

  • memory/2228-17-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2228-14-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2228-15-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2228-16-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2228-12-0x000007FEF601E000-0x000007FEF601F000-memory.dmp

    Filesize

    4KB

  • memory/2228-18-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2228-19-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2228-20-0x000007FEF601E000-0x000007FEF601F000-memory.dmp

    Filesize

    4KB

  • memory/2228-21-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2228-22-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2228-23-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

    Filesize

    9.6MB