Analysis
- max time kernel
14s - max time network
20s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
- submitted
04/01/2025, 05:56
General
- Target JaffaCakes118_7807f36ae4b5685b7219c3afb6d1cf40.exe
- Size 598KB
- Sample250104-gm5ehsxpfj
- SHA256 db927b742687c4dbae86fd0c5adb206968c854df2382a1b9a742d85aa5d704ac
Malware Config
Signatures
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- Revengerat family
- RevengeRat Executable 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7807f36ae4b5685b7219c3afb6d1cf40.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7807f36ae4b5685b7219c3afb6d1cf40.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exeC:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe -install -54426709 -chipde -e0beb46587cb4c9ab330b1054a555956 - -BLUB1 -wekpuwyidxfthbua -4591462⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ocs_v71a.exe
wekpuwyidxfthbua.dat
memory/2716-17-0x000007FEF4810000-0x000007FEF51AD000-memory.dmp
memory/2716-14-0x000007FEF4810000-0x000007FEF51AD000-memory.dmp
memory/2716-13-0x000007FEF4810000-0x000007FEF51AD000-memory.dmp
memory/2716-16-0x000007FEF4810000-0x000007FEF51AD000-memory.dmp
memory/2716-12-0x000007FEF4ACE000-0x000007FEF4ACF000-memory.dmp
memory/2716-18-0x000007FEF4810000-0x000007FEF51AD000-memory.dmp
memory/2716-19-0x000007FEF4810000-0x000007FEF51AD000-memory.dmp
memory/2716-20-0x000007FEF4ACE000-0x000007FEF4ACF000-memory.dmp
memory/2716-21-0x000007FEF4810000-0x000007FEF51AD000-memory.dmp
memory/2716-22-0x000007FEF4810000-0x000007FEF51AD000-memory.dmp
memory/2716-23-0x000007FEF4810000-0x000007FEF51AD000-memory.dmp
memory/2716-24-0x000007FEF4810000-0x000007FEF51AD000-memory.dmp
memory/2716-25-0x000007FEF4810000-0x000007FEF51AD000-memory.dmp