revengerat | 7b97ab70cc010d10a3efc26a16be3e3647f945db3c4a6caf2418b9ebc09d7fd5

Analysis

max time kernel
63s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02-01-2025 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_675d2381ec2849ca62e08bf3ea71a620.exe
Size

598KB
MD5

675d2381ec2849ca62e08bf3ea71a620
SHA1

d0be97d05f308622408c779d6ed70419e2ca1190
SHA256

7b97ab70cc010d10a3efc26a16be3e3647f945db3c4a6caf2418b9ebc09d7fd5
SHA512

8cf67831661ac1006cb750de9d56e03c2a828ac83bffb725fcac7510b31471afb9a28bc317392cde324f53e6965fac74157c6f64675105440d4c031bcf6076f1
SSDEEP

6144:EKWlw1DxD0ASIAfCEv2YUMNJlaJuNlK17Y4c83fhysVufBn597NX2p:E7lw1Dx45zfXeYU43fiysgfBnnl2p

Score

10^/10

revengerat discovery stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x000700000001961c-5.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
576	ocs_v71a.exe

Loads dropped DLL 2 IoCs

pid	Process
1172	JaffaCakes118_675d2381ec2849ca62e08bf3ea71a620.exe
1172	JaffaCakes118_675d2381ec2849ca62e08bf3ea71a620.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_675d2381ec2849ca62e08bf3ea71a620.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1172	JaffaCakes118_675d2381ec2849ca62e08bf3ea71a620.exe
576	ocs_v71a.exe
576	ocs_v71a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 576	1172	JaffaCakes118_675d2381ec2849ca62e08bf3ea71a620.exe	30
PID 1172 wrote to memory of 576	1172	JaffaCakes118_675d2381ec2849ca62e08bf3ea71a620.exe	30
PID 1172 wrote to memory of 576	1172	JaffaCakes118_675d2381ec2849ca62e08bf3ea71a620.exe	30
PID 1172 wrote to memory of 576	1172	JaffaCakes118_675d2381ec2849ca62e08bf3ea71a620.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_675d2381ec2849ca62e08bf3ea71a620.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_675d2381ec2849ca62e08bf3ea71a620.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe
  C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe -install -54419076 -chipde -21750ff4c4d64e2b8c597b6eeafb09c8 - -BLUB1 -pesxqiqdcsojqpsq -524630
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OCS\pesxqiqdcsojqpsq.dat

Filesize
81B

MD5
9c592314ebf01f62161885b938abb686

SHA1
9ad1b00f1db36ebbd42cf2068a994e5d052e327e

SHA256
c980aa505bc0427ec46dda1d0877333864e73baa46c63000e22dbee04619ed17

SHA512
9ee7ec3c1bf6b457d38df516ae008900d22ca5e3a6bb3d59c2f9b32effe451f9ec706d9de21840a5a113cc31d23d17d188a6d6dd576a2c989be712925724e7fb

Download Submit
\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe

Filesize
288KB

MD5
317ec5f92cfbf04a53e8125b66b3b4af

SHA1
16068b8977b4dc562ae782d91bc009472667e331

SHA256
7612ef3877c3e4e305a6c22941141601b489a73bc088622a40ebd93bee25bae5

SHA512
ed772da641a5c128677c4c285c648c1d8e539c34522b95c14f614797bb0d188571c7c257441d45598809aa3f8b4690bd53230282726e077c86c8d9fe71c1db65

Download Submit
memory/576-12-0x000007FEF512E000-0x000007FEF512F000-memory.dmp

Filesize
4KB

Download
memory/576-14-0x000007FEF4E70000-0x000007FEF580D000-memory.dmp

Filesize
9.6MB

Download
memory/576-15-0x000007FEF4E70000-0x000007FEF580D000-memory.dmp

Filesize
9.6MB

Download
memory/576-16-0x000007FEF4E70000-0x000007FEF580D000-memory.dmp

Filesize
9.6MB

Download
memory/576-17-0x000007FEF4E70000-0x000007FEF580D000-memory.dmp

Filesize
9.6MB

Download
memory/576-18-0x000007FEF4E70000-0x000007FEF580D000-memory.dmp

Filesize
9.6MB

Download
memory/576-19-0x000007FEF4E70000-0x000007FEF580D000-memory.dmp

Filesize
9.6MB

Download
memory/576-20-0x000007FEF4E70000-0x000007FEF580D000-memory.dmp

Filesize
9.6MB

Download
memory/576-21-0x000007FEF4E70000-0x000007FEF580D000-memory.dmp

Filesize
9.6MB

Download