Analysis
- max time kernel
148s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
22/08/2024, 00:21
General
- Target b59e2481ae96e2fd6a0cd471369c9c16_JaffaCakes118.exe
- Size 17KB
- Sample240822-anm4assdnl
- SHA256 13bfc53b0932107b8db1e5d979229ff9317ebc1f32f0d82b92c3a8611d1d1cb4
Malware Config
Signatures
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- RevengeRat Executable 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b59e2481ae96e2fd6a0cd471369c9c16_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b59e2481ae96e2fd6a0cd471369c9c16_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Powergeez.exe"C:\Users\Admin\AppData\Roaming\Powergeez.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Powergeez.exe
memory/2036-21-0x00007FFF12FA0000-0x00007FFF13941000-memory.dmp
memory/2036-20-0x00007FFF12FA0000-0x00007FFF13941000-memory.dmp
memory/2036-19-0x00007FFF12FA0000-0x00007FFF13941000-memory.dmp
memory/2036-17-0x00007FFF12FA0000-0x00007FFF13941000-memory.dmp
memory/4856-3-0x000000001BD20000-0x000000001BDC6000-memory.dmp
memory/4856-6-0x00007FFF13255000-0x00007FFF13256000-memory.dmp
memory/4856-7-0x00007FFF12FA0000-0x00007FFF13941000-memory.dmp
memory/4856-5-0x00007FFF12FA0000-0x00007FFF13941000-memory.dmp
memory/4856-4-0x000000001BDD0000-0x000000001BE32000-memory.dmp
memory/4856-18-0x00007FFF12FA0000-0x00007FFF13941000-memory.dmp
memory/4856-0-0x00007FFF13255000-0x00007FFF13256000-memory.dmp
memory/4856-2-0x000000001B850000-0x000000001BD1E000-memory.dmp
memory/4856-1-0x00007FFF12FA0000-0x00007FFF13941000-memory.dmp