Analysis
- max time kernel
145s - max time network
153s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
- submitted
31/08/2024, 21:55
General
- Target cdab5970c5e3d12116faceea2b0b7ed9_JaffaCakes118.exe
- Size 811KB
- Sample240831-1s2elaxeqa
- SHA256 8a3c1ca12b7f67078c31a08b66d0c126d55177da3dc42cdf2f80a593ab9548d8
Malware Config
Extracted
-
webmonitor
-
arglobal.wm01.to:443
-
config_key
ziKbg2IBpBxL34Yr4SWnQnV4SqpF6Yy4
-
private_key
X2HBeL4iM
-
url_path
/recv4.php
Signatures
- RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
- WebMonitor payload 11 IoCs
- Drops startup file 1 IoCs
- UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdab5970c5e3d12116faceea2b0b7ed9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cdab5970c5e3d12116faceea2b0b7ed9_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\314r5n4e\314r5n4e.cmdline"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9675.tmp" "c:\Users\Admin\AppData\Local\Temp\314r5n4e\CSCADE1F0F99FBE4076B4B554BC61D9582B.TMP"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
314r5n4e.dll
314r5n4e.pdb
RES9675.tmp
314r5n4e.0.cs
314r5n4e.cmdline
CSCADE1F0F99FBE4076B4B554BC61D9582B.TMP
memory/1848-0-0x0000000073EEE000-0x0000000073EEF000-memory.dmp
memory/1848-4-0x0000000073EE0000-0x00000000745CE000-memory.dmp
memory/1848-17-0x0000000000200000-0x000000000020A000-memory.dmp
memory/1848-1-0x0000000000990000-0x0000000000A4A000-memory.dmp
memory/1848-20-0x0000000000540000-0x000000000054C000-memory.dmp
memory/1848-19-0x0000000002040000-0x00000000020A8000-memory.dmp
memory/1848-23-0x00000000020B0000-0x0000000002199000-memory.dmp
memory/1848-33-0x0000000073EE0000-0x00000000745CE000-memory.dmp
memory/2688-24-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/2688-36-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/2688-32-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/2688-25-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/2688-31-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/2688-35-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/2688-34-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/2688-29-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/2688-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2688-26-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/2688-38-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/2688-39-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/2688-41-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/2688-43-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/2688-45-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/2688-46-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/2688-48-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/2688-50-0x0000000000400000-0x00000000004E9000-memory.dmp