webmonitor | 84d9088f856e12f998ce324510f185b9e6939c8d1cb2cdb46eb9b38baf879619

General

Target

BANKING_DETAILS..exe
Size

1.6MB
MD5

2d29230b77724882289e74bb9e69b95d
SHA1

4be47bbd5110c38b3312ab232570051f6335b65b
SHA256

84d9088f856e12f998ce324510f185b9e6939c8d1cb2cdb46eb9b38baf879619
SHA512

eba2141dc9f1d40cfd60efb861f01d7dcf3e45fe17858e1a336c8a618e88ba4c077a73bd9374f7102d681adc98ebb43279dd13eb0974f272eac90bcfbe2f1a70

Score

10^/10

webmonitor backdoor infostealer rat

Malware Config

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1720-138-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral2/memory/1720-139-0x000000000049D8CA-mapping.dmp	family_webmonitor
behavioral2/memory/1720-150-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor

Suspicious use of SetThreadContext 1 IoCs

Processes:

BANKING_DETAILS..exe

description pid process target process

PID 672 set thread context of 1720 672 BANKING_DETAILS..exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3560 schtasks.exe

description	pid	process	target process
PID 672 set thread context of 1720	672	BANKING_DETAILS..exe	RegSvcs.exe

pid	process
3560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

BANKING_DETAILS..exepowershell.exepowershell.exepowershell.exe

pid	process
672	BANKING_DETAILS..exe
1412	powershell.exe
3880	powershell.exe
3056	powershell.exe
3880	powershell.exe
3056	powershell.exe
1412	powershell.exe
3880	powershell.exe
3056	powershell.exe
1412	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

BANKING_DETAILS..exepowershell.exepowershell.exepowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	672	BANKING_DETAILS..exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeShutdownPrivilege	1720	RegSvcs.exe
Token: SeCreatePagefilePrivilege	1720	RegSvcs.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

BANKING_DETAILS..exe

description	pid	process	target process
PID 672 wrote to memory of 1412	672	BANKING_DETAILS..exe	powershell.exe
PID 672 wrote to memory of 1412	672	BANKING_DETAILS..exe	powershell.exe
PID 672 wrote to memory of 1412	672	BANKING_DETAILS..exe	powershell.exe
PID 672 wrote to memory of 3880	672	BANKING_DETAILS..exe	powershell.exe
PID 672 wrote to memory of 3880	672	BANKING_DETAILS..exe	powershell.exe
PID 672 wrote to memory of 3880	672	BANKING_DETAILS..exe	powershell.exe
PID 672 wrote to memory of 3560	672	BANKING_DETAILS..exe	schtasks.exe
PID 672 wrote to memory of 3560	672	BANKING_DETAILS..exe	schtasks.exe
PID 672 wrote to memory of 3560	672	BANKING_DETAILS..exe	schtasks.exe
PID 672 wrote to memory of 3056	672	BANKING_DETAILS..exe	powershell.exe
PID 672 wrote to memory of 3056	672	BANKING_DETAILS..exe	powershell.exe
PID 672 wrote to memory of 3056	672	BANKING_DETAILS..exe	powershell.exe
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	RegSvcs.exe
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	RegSvcs.exe
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	RegSvcs.exe
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	RegSvcs.exe
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	RegSvcs.exe
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	RegSvcs.exe
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	RegSvcs.exe
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	RegSvcs.exe
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\BANKING_DETAILS..exe
"C:\Users\Admin\AppData\Local\Temp\BANKING_DETAILS..exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\BANKING_DETAILS..exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1412

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pfIFOKgKlLO.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3880

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pfIFOKgKlLO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp48A2.tmp"
2⤵
- Creates scheduled task(s)
PID:3560

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pfIFOKgKlLO.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ozx3FNgmYfNdFqfV.bat" "
3⤵
PID:612

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ozx3FNgmYfNdFqfV.bat
MD5
03df43fbc7691860dc4782a9ff6263a0

SHA1
af75fa72ccc1708ff44d2993eaecbf88d3b9f11b

SHA256
3908150361e9f48347511b04a9d51f15d299c2b0aab67bec6126034e49d74238

SHA512
4810adffef1af6dfb205d94e7c803ae3d52abe84d2e7ee16d28108614e64bc374beac137301230c4cd0e9c199c34dbd85015779ffa6b2fa45e0877558ad7ccd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp48A2.tmp
MD5
80b7b63d6afa39003690863088adc1f4

SHA1
5a464f22aa794582382004e99c0013d9bae1756a

SHA256
adf486bbd6100def14326f5c28d936f3efa28fee4beb81b1607b382e8f875c55

SHA512
75b7ef33a86904debb4d1a9d485b241fe15068098602d4d4d032739deb7e27e66a48c152e5e897e5050e95bad080808eb801e9c3acff2fbe08bffb452d05a5e4

Download Submit
memory/612-516-0x0000000000000000-mapping.dmp

Download
memory/672-121-0x00000000052C0000-0x00000000052C1000-memory.dmp

Filesize
4KB

Download
memory/672-119-0x0000000005160000-0x000000000565E000-memory.dmp

Filesize
5.0MB

Download
memory/672-120-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/672-118-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download
memory/672-122-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/672-123-0x0000000006150000-0x00000000062A8000-memory.dmp

Filesize
1.3MB

Download
memory/672-124-0x0000000006370000-0x0000000006483000-memory.dmp

Filesize
1.1MB

Download
memory/672-117-0x0000000005660000-0x0000000005661000-memory.dmp

Filesize
4KB

Download
memory/672-116-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/672-114-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1412-146-0x0000000000D22000-0x0000000000D23000-memory.dmp

Filesize
4KB

Download
memory/1412-215-0x000000007F590000-0x000000007F591000-memory.dmp

Filesize
4KB

Download
memory/1412-194-0x0000000008A60000-0x0000000008A93000-memory.dmp

Filesize
204KB

Download
memory/1412-246-0x0000000000D23000-0x0000000000D24000-memory.dmp

Filesize
4KB

Download
memory/1412-144-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/1412-130-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/1412-131-0x0000000006D90000-0x0000000006D91000-memory.dmp

Filesize
4KB

Download
memory/1412-125-0x0000000000000000-mapping.dmp

Download
memory/1720-138-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1720-139-0x000000000049D8CA-mapping.dmp

Download
memory/1720-150-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3056-154-0x0000000001182000-0x0000000001183000-memory.dmp

Filesize
4KB

Download
memory/3056-151-0x0000000001180000-0x0000000001181000-memory.dmp

Filesize
4KB

Download
memory/3056-137-0x0000000000000000-mapping.dmp

Download
memory/3056-240-0x0000000001183000-0x0000000001184000-memory.dmp

Filesize
4KB

Download
memory/3056-217-0x0000000008230000-0x0000000008231000-memory.dmp

Filesize
4KB

Download
memory/3056-160-0x00000000079C0000-0x00000000079C1000-memory.dmp

Filesize
4KB

Download
memory/3056-163-0x0000000007750000-0x0000000007751000-memory.dmp

Filesize
4KB

Download
memory/3056-166-0x0000000007ED0000-0x0000000007ED1000-memory.dmp

Filesize
4KB

Download
memory/3056-169-0x0000000008110000-0x0000000008111000-memory.dmp

Filesize
4KB

Download
memory/3056-216-0x000000007E510000-0x000000007E511000-memory.dmp

Filesize
4KB

Download
memory/3560-129-0x0000000000000000-mapping.dmp

Download
memory/3880-149-0x00000000011E2000-0x00000000011E3000-memory.dmp

Filesize
4KB

Download
memory/3880-214-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/3880-156-0x0000000007770000-0x0000000007771000-memory.dmp

Filesize
4KB

Download
memory/3880-145-0x0000000007000000-0x0000000007001000-memory.dmp

Filesize
4KB

Download
memory/3880-245-0x00000000011E3000-0x00000000011E4000-memory.dmp

Filesize
4KB

Download
memory/3880-148-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/3880-128-0x0000000000000000-mapping.dmp

Download
memory/3880-152-0x0000000007700000-0x0000000007701000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads