webmonitor | d6593053bda046cd96e0e5e508e0f57622c464738838b84984e35e683d46c414

General

Target

Banking_cordinates_928273.exe
Size

1.9MB
MD5

fac4b5a9c4f10517f44d4ae172f6473c
SHA1

2304b22499e60fa87ea5f9d3fee5f6d9ecacf9ee
SHA256

d6593053bda046cd96e0e5e508e0f57622c464738838b84984e35e683d46c414
SHA512

6b8dc4430f6068eaac9d27e4f322d1ae921f56b9940e266ba44ed791917c37b14bb9cb1ea3b861da36d9efe44af7acf75264e19d60a5fb1e89deabd1afa1bdbc

Score

10^/10

webmonitor backdoor infostealer persistence rat suricata

Malware Config

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1400-67-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/1400-68-0x000000000049D8CA-mapping.dmp	family_webmonitor
behavioral1/memory/1400-70-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor

suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
suricata

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/604-62-0x0000000000480000-0x000000000048B000-memory.dmp	CustAttr

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebMonitor-ced9 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-ced9.exe"	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WebMonitor-ced9 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-ced9.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Banking_cordinates_928273.exe

description pid process target process

PID 604 set thread context of 1400 604 Banking_cordinates_928273.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

568 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Banking_cordinates_928273.exe

pid process

604 Banking_cordinates_928273.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Banking_cordinates_928273.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 604 Banking_cordinates_928273.exe
Token: SeShutdownPrivilege 1400 RegSvcs.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

1400 RegSvcs.exe

description	pid	process	target process
PID 604 set thread context of 1400	604	Banking_cordinates_928273.exe	RegSvcs.exe

pid	process
568	schtasks.exe

pid	process
604	Banking_cordinates_928273.exe

description	pid	process
Token: SeDebugPrivilege	604	Banking_cordinates_928273.exe
Token: SeShutdownPrivilege	1400	RegSvcs.exe

pid	process
1400	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Banking_cordinates_928273.exe

description	pid	process	target process
PID 604 wrote to memory of 568	604	Banking_cordinates_928273.exe	schtasks.exe
PID 604 wrote to memory of 568	604	Banking_cordinates_928273.exe	schtasks.exe
PID 604 wrote to memory of 568	604	Banking_cordinates_928273.exe	schtasks.exe
PID 604 wrote to memory of 568	604	Banking_cordinates_928273.exe	schtasks.exe
PID 604 wrote to memory of 1400	604	Banking_cordinates_928273.exe	RegSvcs.exe
PID 604 wrote to memory of 1400	604	Banking_cordinates_928273.exe	RegSvcs.exe
PID 604 wrote to memory of 1400	604	Banking_cordinates_928273.exe	RegSvcs.exe
PID 604 wrote to memory of 1400	604	Banking_cordinates_928273.exe	RegSvcs.exe
PID 604 wrote to memory of 1400	604	Banking_cordinates_928273.exe	RegSvcs.exe
PID 604 wrote to memory of 1400	604	Banking_cordinates_928273.exe	RegSvcs.exe
PID 604 wrote to memory of 1400	604	Banking_cordinates_928273.exe	RegSvcs.exe
PID 604 wrote to memory of 1400	604	Banking_cordinates_928273.exe	RegSvcs.exe
PID 604 wrote to memory of 1400	604	Banking_cordinates_928273.exe	RegSvcs.exe
PID 604 wrote to memory of 1400	604	Banking_cordinates_928273.exe	RegSvcs.exe
PID 604 wrote to memory of 1400	604	Banking_cordinates_928273.exe	RegSvcs.exe
PID 604 wrote to memory of 1400	604	Banking_cordinates_928273.exe	RegSvcs.exe
PID 604 wrote to memory of 1400	604	Banking_cordinates_928273.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Banking_cordinates_928273.exe
"C:\Users\Admin\AppData\Local\Temp\Banking_cordinates_928273.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:604

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WLmzCRrQBmjpU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpACF2.tmp"
2⤵
- Creates scheduled task(s)
PID:568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1400

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpACF2.tmp
MD5
550ba0ca280bf477806041d2378a3f92

SHA1
986b23b30a55c05c15cfe420999b57439078506a

SHA256
72a5fd2959b4daf073ff47fe8196358fdbb8be6ba338f657231154dd62ef1540

SHA512
ab3b4b109ea6f46ad2e8d7079046f6616157814b3229c107f59e0b36ac120e6310cabf22b2bafc2b61d57e7b1995515063eec736036df2b3b9b67f4ebb52b746

Download Submit
memory/568-65-0x0000000000000000-mapping.dmp

Download
memory/604-59-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/604-61-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/604-62-0x0000000000480000-0x000000000048B000-memory.dmp

Filesize
44KB

Download
memory/604-63-0x0000000005850000-0x0000000005980000-memory.dmp

Filesize
1.2MB

Download
memory/604-64-0x0000000005980000-0x0000000005A70000-memory.dmp

Filesize
960KB

Download
memory/1400-67-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1400-68-0x000000000049D8CA-mapping.dmp

Download
memory/1400-69-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1400-70-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1400-71-0x0000000002DC0000-0x0000000003DC0000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads