Overview

overview

10

Static

static

JANUARY OV...df.exe

windows7_x64

10

JANUARY OV...df.exe

windows10_x64

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    07-04-2021 05:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JANUARY OVERDUE INVOICE.pdf.exe

  • Size

    1.5MB

  • MD5

    f7d79ec6a3bf524f8f0c0e8d54949948

  • SHA1

    ff9535613f977f6321a1eca20c50e97d23c83259

  • SHA256

    b4fbe906439597a3d05b94f3a7001069687e598cabc9a82e47d6c43046be10a5

  • SHA512

    27dd0344afe613f24147e08aa1208e0fbea2c6618a69a97e48b94a9f412b44273dfd268653dcaec7a83e7fdb10601b6c58ee90bc412601879308f69f7d5d2783

Score
10/10
webmonitorbackdoorinfostealerrat

Malware Config

Signatures

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

    backdoorratinfostealerwebmonitor
  • WebMonitor Payload 4 IoCs
  • CustAttr .NET packer 1 IoCs

    Detects CustAttr .NET packer in memory.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JANUARY OVERDUE INVOICE.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\JANUARY OVERDUE INVOICE.pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LbDmDauhDnWnVS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEB0.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1500
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpEB0.tmp
    MD5

    40c2abe04e722370140730fe09f5c508

    SHA1

    bf92cc17c74ede6ea36938dc0c3ac7417dd825f4

    SHA256

    d5f09247abdaa637c3ca75ab68348a69376d042ca6fed2536c316244f623f689

    SHA512

    db37f625212f5c5c0f349a2f5d977c7916463fd5146220db4ff552349b6c57871ccd84ee4ffd701918852d71e3ab8630c93e5a5aa8bb99bbfd7c2e9465dadcef

    Download Submit
  • memory/576-15-0x0000000000400000-0x00000000004F3000-memory.dmp
    Filesize

    972KB

    Download
  • memory/576-14-0x0000000074B31000-0x0000000074B33000-memory.dmp
    Filesize

    8KB

    Download
  • memory/576-17-0x0000000002F30000-0x0000000003F30000-memory.dmp
    Filesize

    16.0MB

    Download
  • memory/576-16-0x0000000000400000-0x00000000004F3000-memory.dmp
    Filesize

    972KB

    Download
  • memory/576-13-0x000000000049D8CA-mapping.dmp
    Download
  • memory/576-12-0x0000000000400000-0x00000000004F3000-memory.dmp
    Filesize

    972KB

    Download
  • memory/840-18-0x000007FEF7080000-0x000007FEF72FA000-memory.dmp
    Filesize

    2.5MB

    Download
  • memory/1500-10-0x0000000000000000-mapping.dmp
    Download
  • memory/1668-5-0x0000000001230000-0x0000000001231000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1668-9-0x0000000005340000-0x0000000005439000-memory.dmp
    Filesize

    996KB

    Download
  • memory/1668-8-0x0000000005250000-0x000000000533D000-memory.dmp
    Filesize

    948KB

    Download
  • memory/1668-3-0x0000000001270000-0x0000000001271000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1668-2-0x0000000074110000-0x00000000747FE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1668-7-0x000000007EF40000-0x000000007EF41000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1668-6-0x00000000006B0000-0x00000000006B4000-memory.dmp
    Filesize

    16KB

    Download