webmonitor | 040c45babc21c9d265f313350132ea4b6fda7765e6ff41a953624abbd418b32a

Analysis

max time kernel
149s
max time network
150s
platform
windows10_x64
resource
win10v20210410
submitted
15-05-2021 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

040c45babc21c9d265f313350132ea4b6fda7765e6ff41a953624abbd418b32a.exe
Size

746KB
MD5

3dfd779873c3aa2e48ca25add371d73e
SHA1

487e18f213332a8f92e8b1ab2449f35eec66931c
SHA256

040c45babc21c9d265f313350132ea4b6fda7765e6ff41a953624abbd418b32a
SHA512

fabb550f212b162a709d44ce39c23c4fbf7c5da264cdd49eccbb5752a773b04cf085ab210b8ebd01f8da762401f322e42dc4f5799beaa477f9620226a1997e8e

Score

10^/10

webmonitor backdoor infostealer persistence rat

Malware Config

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

040c45babc21c9d265f313350132ea4b6fda7765e6ff41a953624abbd418b32a.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebMonitor-48c4 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-48c4.exe휀"	040c45babc21c9d265f313350132ea4b6fda7765e6ff41a953624abbd418b32a.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

040c45babc21c9d265f313350132ea4b6fda7765e6ff41a953624abbd418b32a.exe

pid process

2116 040c45babc21c9d265f313350132ea4b6fda7765e6ff41a953624abbd418b32a.exe

pid	process
2116	040c45babc21c9d265f313350132ea4b6fda7765e6ff41a953624abbd418b32a.exe

C:\Users\Admin\AppData\Local\Temp\040c45babc21c9d265f313350132ea4b6fda7765e6ff41a953624abbd418b32a.exe
"C:\Users\Admin\AppData\Local\Temp\040c45babc21c9d265f313350132ea4b6fda7765e6ff41a953624abbd418b32a.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
PID:2116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads