webmonitor | 84d9088f856e12f998ce324510f185b9e6939c8d1cb2cdb46eb9b38baf879619

General

Target

BANKING_DETAILS..exe
Size

1.6MB
MD5

2d29230b77724882289e74bb9e69b95d
SHA1

4be47bbd5110c38b3312ab232570051f6335b65b
SHA256

84d9088f856e12f998ce324510f185b9e6939c8d1cb2cdb46eb9b38baf879619
SHA512

eba2141dc9f1d40cfd60efb861f01d7dcf3e45fe17858e1a336c8a618e88ba4c077a73bd9374f7102d681adc98ebb43279dd13eb0974f272eac90bcfbe2f1a70

Score

10^/10

webmonitor backdoor infostealer rat

Malware Config

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 3 IoCs

resource	yara_rule
behavioral2/memory/1720-138-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral2/memory/1720-139-0x000000000049D8CA-mapping.dmp	family_webmonitor
behavioral2/memory/1720-150-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 672 set thread context of 1720	672	BANKING_DETAILS..exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
672	BANKING_DETAILS..exe
1412	powershell.exe
3880	powershell.exe
3056	powershell.exe
3880	powershell.exe
3056	powershell.exe
1412	powershell.exe
3880	powershell.exe
3056	powershell.exe
1412	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	672	BANKING_DETAILS..exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeShutdownPrivilege	1720	RegSvcs.exe
Token: SeCreatePagefilePrivilege	1720	RegSvcs.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 1412	672	BANKING_DETAILS..exe	78
PID 672 wrote to memory of 1412	672	BANKING_DETAILS..exe	78
PID 672 wrote to memory of 1412	672	BANKING_DETAILS..exe	78
PID 672 wrote to memory of 3880	672	BANKING_DETAILS..exe	80
PID 672 wrote to memory of 3880	672	BANKING_DETAILS..exe	80
PID 672 wrote to memory of 3880	672	BANKING_DETAILS..exe	80
PID 672 wrote to memory of 3560	672	BANKING_DETAILS..exe	82
PID 672 wrote to memory of 3560	672	BANKING_DETAILS..exe	82
PID 672 wrote to memory of 3560	672	BANKING_DETAILS..exe	82
PID 672 wrote to memory of 3056	672	BANKING_DETAILS..exe	84
PID 672 wrote to memory of 3056	672	BANKING_DETAILS..exe	84
PID 672 wrote to memory of 3056	672	BANKING_DETAILS..exe	84
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	86
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	86
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	86
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	86
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	86
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	86
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	86
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	86
PID 672 wrote to memory of 1720	672	BANKING_DETAILS..exe	86

C:\Users\Admin\AppData\Local\Temp\BANKING_DETAILS..exe
"C:\Users\Admin\AppData\Local\Temp\BANKING_DETAILS..exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\BANKING_DETAILS..exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1412
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pfIFOKgKlLO.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3880
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pfIFOKgKlLO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp48A2.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3560
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pfIFOKgKlLO.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3056
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ozx3FNgmYfNdFqfV.bat" "
    3⤵
    PID:612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-121-0x00000000052C0000-0x00000000052C1000-memory.dmp

Filesize
4KB

Download
memory/672-119-0x0000000005160000-0x000000000565E000-memory.dmp

Filesize
5.0MB

Download
memory/672-120-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/672-118-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download
memory/672-122-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/672-123-0x0000000006150000-0x00000000062A8000-memory.dmp

Filesize
1.3MB

Download
memory/672-124-0x0000000006370000-0x0000000006483000-memory.dmp

Filesize
1.1MB

Download
memory/672-117-0x0000000005660000-0x0000000005661000-memory.dmp

Filesize
4KB

Download
memory/672-116-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/672-114-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1412-146-0x0000000000D22000-0x0000000000D23000-memory.dmp

Filesize
4KB

Download
memory/1412-215-0x000000007F590000-0x000000007F591000-memory.dmp

Filesize
4KB

Download
memory/1412-194-0x0000000008A60000-0x0000000008A93000-memory.dmp

Filesize
204KB

Download
memory/1412-246-0x0000000000D23000-0x0000000000D24000-memory.dmp

Filesize
4KB

Download
memory/1412-144-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/1412-130-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/1412-131-0x0000000006D90000-0x0000000006D91000-memory.dmp

Filesize
4KB

Download
memory/1720-138-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1720-150-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3056-154-0x0000000001182000-0x0000000001183000-memory.dmp

Filesize
4KB

Download
memory/3056-151-0x0000000001180000-0x0000000001181000-memory.dmp

Filesize
4KB

Download
memory/3056-240-0x0000000001183000-0x0000000001184000-memory.dmp

Filesize
4KB

Download
memory/3056-217-0x0000000008230000-0x0000000008231000-memory.dmp

Filesize
4KB

Download
memory/3056-160-0x00000000079C0000-0x00000000079C1000-memory.dmp

Filesize
4KB

Download
memory/3056-163-0x0000000007750000-0x0000000007751000-memory.dmp

Filesize
4KB

Download
memory/3056-166-0x0000000007ED0000-0x0000000007ED1000-memory.dmp

Filesize
4KB

Download
memory/3056-169-0x0000000008110000-0x0000000008111000-memory.dmp

Filesize
4KB

Download
memory/3056-216-0x000000007E510000-0x000000007E511000-memory.dmp

Filesize
4KB

Download
memory/3880-149-0x00000000011E2000-0x00000000011E3000-memory.dmp

Filesize
4KB

Download
memory/3880-214-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/3880-156-0x0000000007770000-0x0000000007771000-memory.dmp

Filesize
4KB

Download
memory/3880-145-0x0000000007000000-0x0000000007001000-memory.dmp

Filesize
4KB

Download
memory/3880-245-0x00000000011E3000-0x00000000011E4000-memory.dmp

Filesize
4KB

Download
memory/3880-148-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/3880-152-0x0000000007700000-0x0000000007701000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads