Analysis
- max time kernel
144s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
- submitted
15/07/2024, 23:23
General
- Target 4bdb1e053a3f893f0a0560124915e26f_JaffaCakes118.exe
- Size 2.0MB
- Sample240715-3dd2vsvajn
- SHA256 74818ceb11f1c538bb637d333c6a6c2cf2606829598c14423878e8ce2e9a9a53
Malware Config
Extracted
-
Protocol
smtp
-
Host
smtp.gmail.com
-
Port
587
-
Username
-
Password
22logitech2212
Signatures
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- RevengeRat Executable 1 IoCs
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 5 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4bdb1e053a3f893f0a0560124915e26f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4bdb1e053a3f893f0a0560124915e26f_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\281.exeC:\Users\Admin\AppData\Local\Temp\281.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /C cd C:\Users\Admin\AppData\Roaming\Microsoft3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C C:\Users\Admin\AppData\Roaming\Microsoft\FirePassword.exe >C:\Users\Admin\AppData\Roaming\Microsoft\Error.txt3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\FirePassword.exeC:\Users\Admin\AppData\Roaming\Microsoft\FirePassword.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
281.exe
Error.txt
FirePassword.exe
nspr4.dll
nss3.dll
plc4.dll
plds4.dll
softokn3.dll
memory/948-16-0x00007FFC368B0000-0x00007FFC37251000-memory.dmp
memory/948-0-0x00007FFC36B65000-0x00007FFC36B66000-memory.dmp
memory/948-1-0x000000001B980000-0x000000001BA26000-memory.dmp
memory/948-2-0x00007FFC368B0000-0x00007FFC37251000-memory.dmp
memory/948-7-0x00007FFC368B0000-0x00007FFC37251000-memory.dmp
memory/1344-51-0x0000000060220000-0x0000000060229000-memory.dmp
memory/1344-50-0x0000000060210000-0x000000006021A000-memory.dmp
memory/1344-61-0x0000000060260000-0x00000000602BF000-memory.dmp
memory/1344-48-0x0000000060170000-0x00000000601D7000-memory.dmp
memory/1344-60-0x0000000060220000-0x0000000060229000-memory.dmp
memory/1344-59-0x0000000060210000-0x000000006021A000-memory.dmp
memory/1344-58-0x0000000060140000-0x000000006016D000-memory.dmp
memory/1344-49-0x0000000060140000-0x000000006016D000-memory.dmp
memory/1344-36-0x0000000000400000-0x000000000046B000-memory.dmp
memory/1344-52-0x0000000060260000-0x00000000602BF000-memory.dmp
memory/1344-53-0x0000000000400000-0x000000000046B000-memory.dmp
memory/1452-25-0x00007FFC368B0000-0x00007FFC37251000-memory.dmp
memory/1452-32-0x00007FFC368B0000-0x00007FFC37251000-memory.dmp
memory/1452-31-0x00007FFC368B0000-0x00007FFC37251000-memory.dmp
memory/1452-24-0x00007FFC368B0000-0x00007FFC37251000-memory.dmp
memory/1452-22-0x000000001D380000-0x000000001D399000-memory.dmp
memory/1452-21-0x00007FFC368B0000-0x00007FFC37251000-memory.dmp
memory/1452-47-0x00007FFC368B0000-0x00007FFC37251000-memory.dmp
memory/1452-20-0x00007FFC368B0000-0x00007FFC37251000-memory.dmp
memory/1452-19-0x000000001D2F0000-0x000000001D352000-memory.dmp
memory/1452-18-0x00007FFC368B0000-0x00007FFC37251000-memory.dmp
memory/1452-17-0x00007FFC368B0000-0x00007FFC37251000-memory.dmp
memory/1452-15-0x00007FFC368B0000-0x00007FFC37251000-memory.dmp
memory/1452-13-0x00007FFC368B0000-0x00007FFC37251000-memory.dmp
memory/1452-12-0x00007FFC368B0000-0x00007FFC37251000-memory.dmp
memory/1452-11-0x000000001C330000-0x000000001C37C000-memory.dmp
memory/1452-10-0x0000000000F70000-0x0000000000F78000-memory.dmp
memory/1452-9-0x000000001C1D0000-0x000000001C26C000-memory.dmp
memory/1452-63-0x00007FFC368B0000-0x00007FFC37251000-memory.dmp
memory/1452-8-0x000000001BC50000-0x000000001C11E000-memory.dmp