Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
04/01/2025, 05:56
General
- Target JaffaCakes118_7807f36ae4b5685b7219c3afb6d1cf40.exe
- Size 598KB
- Sample250104-gm5ehsxpfj
- SHA256 db927b742687c4dbae86fd0c5adb206968c854df2382a1b9a742d85aa5d704ac
Malware Config
Signatures
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- Revengerat family
- RevengeRat Executable 1 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7807f36ae4b5685b7219c3afb6d1cf40.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7807f36ae4b5685b7219c3afb6d1cf40.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exeC:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe -install -54426709 -chipde -e0beb46587cb4c9ab330b1054a555956 - -BLUB1 -jkldllsibjddwjxp -6554482⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
jkldllsibjddwjxp.dat
ocs_v71a.exe
memory/1084-11-0x000000001B7E0000-0x000000001B886000-memory.dmp
memory/1084-18-0x00007FFEC96E0000-0x00007FFECA081000-memory.dmp
memory/1084-10-0x000000001BD90000-0x000000001C25E000-memory.dmp
memory/1084-12-0x000000001C300000-0x000000001C39C000-memory.dmp
memory/1084-13-0x00000000011E0000-0x00000000011E8000-memory.dmp
memory/1084-14-0x00007FFEC96E0000-0x00007FFECA081000-memory.dmp
memory/1084-8-0x00007FFEC9995000-0x00007FFEC9996000-memory.dmp
memory/1084-16-0x00007FFEC96E0000-0x00007FFECA081000-memory.dmp
memory/1084-17-0x00007FFEC96E0000-0x00007FFECA081000-memory.dmp
memory/1084-9-0x00007FFEC96E0000-0x00007FFECA081000-memory.dmp
memory/1084-19-0x00007FFEC96E0000-0x00007FFECA081000-memory.dmp
memory/1084-20-0x00007FFEC96E0000-0x00007FFECA081000-memory.dmp
memory/1084-21-0x00007FFEC96E0000-0x00007FFECA081000-memory.dmp
memory/1084-22-0x00007FFEC9995000-0x00007FFEC9996000-memory.dmp
memory/1084-23-0x00007FFEC96E0000-0x00007FFECA081000-memory.dmp
memory/1084-24-0x00007FFEC96E0000-0x00007FFECA081000-memory.dmp
memory/1084-26-0x00007FFEC96E0000-0x00007FFECA081000-memory.dmp