webmonitor | 968cf1954069babdf367259271ba34fc1e149a18255c45fc8138d0da2b3dd413

General

Target

MATCH_OUTSTANDING_BILL.exe
Size

1.3MB
MD5

bd35dd1bc38521c4feb42f5ca266900c
SHA1

72ff48fbd0d0db7ee83e90edee6d90eee6719a57
SHA256

968cf1954069babdf367259271ba34fc1e149a18255c45fc8138d0da2b3dd413
SHA512

06aa1b4ad24c9ccfab98cc71c4ee6c88e4e4375b8641f738eebbeb0c8c67719f7596de47935597f894a36934b1cb6364c9ffbb6910ddea6e92182ddae4959ab1

Score

10^/10

webmonitor backdoor infostealer persistence rat

Malware Config

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 3 IoCs

resource	yara_rule
behavioral1/memory/332-65-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/332-66-0x000000000049D8CA-mapping.dmp	family_webmonitor
behavioral1/memory/332-68-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebMonitor-3c00 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-3c00.exe"	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WebMonitor-3c00 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-3c00.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1816 set thread context of 332	1816	MATCH_OUTSTANDING_BILL.exe	29

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	332	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
332	RegSvcs.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 332	1816	MATCH_OUTSTANDING_BILL.exe	29
PID 1816 wrote to memory of 332	1816	MATCH_OUTSTANDING_BILL.exe	29
PID 1816 wrote to memory of 332	1816	MATCH_OUTSTANDING_BILL.exe	29
PID 1816 wrote to memory of 332	1816	MATCH_OUTSTANDING_BILL.exe	29
PID 1816 wrote to memory of 332	1816	MATCH_OUTSTANDING_BILL.exe	29
PID 1816 wrote to memory of 332	1816	MATCH_OUTSTANDING_BILL.exe	29
PID 1816 wrote to memory of 332	1816	MATCH_OUTSTANDING_BILL.exe	29
PID 1816 wrote to memory of 332	1816	MATCH_OUTSTANDING_BILL.exe	29
PID 1816 wrote to memory of 332	1816	MATCH_OUTSTANDING_BILL.exe	29
PID 1816 wrote to memory of 332	1816	MATCH_OUTSTANDING_BILL.exe	29
PID 1816 wrote to memory of 332	1816	MATCH_OUTSTANDING_BILL.exe	29
PID 1816 wrote to memory of 332	1816	MATCH_OUTSTANDING_BILL.exe	29
PID 1816 wrote to memory of 332	1816	MATCH_OUTSTANDING_BILL.exe	29

C:\Users\Admin\AppData\Local\Temp\MATCH_OUTSTANDING_BILL.exe
"C:\Users\Admin\AppData\Local\Temp\MATCH_OUTSTANDING_BILL.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/332-65-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/332-67-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/332-68-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/332-69-0x0000000002C20000-0x0000000003C20000-memory.dmp

Filesize
16.0MB

Download
memory/1816-59-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/1816-61-0x0000000000250000-0x000000000026B000-memory.dmp

Filesize
108KB

Download
memory/1816-62-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/1816-63-0x0000000005250000-0x0000000005350000-memory.dmp

Filesize
1024KB

Download
memory/1816-64-0x0000000007840000-0x000000000793E000-memory.dmp

Filesize
1016KB

Download

Analysis

Sharing