Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
04/01/2025, 08:59
General
- Target JaffaCakes118_78ce19e041faa67ab75a560d21eec820.exe
- Size 936KB
- Sample250104-kxtbsasmfz
- SHA256 3d66a969bd3e6d40bcc4a84d7cb45fb246e9d3178853a0542c703c5f74f2d9ba
Malware Config
Signatures
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- Revengerat family
- RevengeRat Executable 1 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78ce19e041faa67ab75a560d21eec820.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78ce19e041faa67ab75a560d21eec820.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71b.exeC:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71b.exe -install -4871177 -techradar -0b74502c2fe34db2ae29d84d3485c7c0 - - -rizsgkqhdzmfdyyc -5899262⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ocs_v71b.exe
rizsgkqhdzmfdyyc.dat
memory/116-15-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp
memory/116-16-0x00007FFD37FB3000-0x00007FFD37FB5000-memory.dmp
memory/116-11-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp
memory/116-12-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp
memory/116-13-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp
memory/116-14-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp
memory/116-8-0x00007FFD37FB3000-0x00007FFD37FB5000-memory.dmp
memory/116-9-0x00000000001C0000-0x0000000000216000-memory.dmp
memory/116-17-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp
memory/116-18-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp
memory/116-19-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp
memory/116-20-0x000000001D590000-0x000000001DCE7000-memory.dmp
memory/116-21-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp
memory/116-22-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp
memory/116-26-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp
memory/116-28-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp