Analysis
- max time kernel
141s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
31/08/2024, 21:55
General
- Target cdab5970c5e3d12116faceea2b0b7ed9_JaffaCakes118.exe
- Size 811KB
- Sample240831-1s2elaxeqa
- SHA256 8a3c1ca12b7f67078c31a08b66d0c126d55177da3dc42cdf2f80a593ab9548d8
Malware Config
Extracted
-
webmonitor
-
arglobal.wm01.to:443
-
config_key
ziKbg2IBpBxL34Yr4SWnQnV4SqpF6Yy4
-
private_key
X2HBeL4iM
-
url_path
/recv4.php
Signatures
- RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
- WebMonitor payload 14 IoCs
- Drops startup file 1 IoCs
- UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Unexpected DNS network traffic destination 15 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdab5970c5e3d12116faceea2b0b7ed9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cdab5970c5e3d12116faceea2b0b7ed9_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oju5c4vv\oju5c4vv.cmdline"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES95E7.tmp" "c:\Users\Admin\AppData\Local\Temp\oju5c4vv\CSC9BC867EC41BA425E9965A9D14B2BA3E8.TMP"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
RES95E7.tmp
oju5c4vv.dll
oju5c4vv.pdb
CSC9BC867EC41BA425E9965A9D14B2BA3E8.TMP
oju5c4vv.0.cs
oju5c4vv.cmdline
memory/3196-0-0x000000007489E000-0x000000007489F000-memory.dmp
memory/3196-5-0x0000000074890000-0x0000000075040000-memory.dmp
memory/3196-1-0x0000000000A00000-0x0000000000ABA000-memory.dmp
memory/3196-17-0x0000000005380000-0x000000000538A000-memory.dmp
memory/3196-19-0x0000000005430000-0x00000000054C2000-memory.dmp
memory/3196-20-0x00000000055F0000-0x0000000005658000-memory.dmp
memory/3196-21-0x0000000005500000-0x000000000550C000-memory.dmp
memory/3196-24-0x0000000005A90000-0x0000000005B79000-memory.dmp
memory/3196-25-0x0000000005D40000-0x0000000005DDC000-memory.dmp
memory/3196-32-0x0000000074890000-0x0000000075040000-memory.dmp
memory/4052-28-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/4052-39-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/4052-30-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/4052-31-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/4052-26-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/4052-33-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/4052-35-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/4052-36-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/4052-38-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/4052-29-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/4052-40-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/4052-41-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/4052-42-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/4052-43-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/4052-44-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/4052-46-0x0000000000400000-0x00000000004E9000-memory.dmp
memory/4052-47-0x0000000000400000-0x00000000004E9000-memory.dmp