webmonitor | d6593053bda046cd96e0e5e508e0f57622c464738838b84984e35e683d46c414

General

Target

Banking_cordinates_928273.exe
Size

1.9MB
MD5

fac4b5a9c4f10517f44d4ae172f6473c
SHA1

2304b22499e60fa87ea5f9d3fee5f6d9ecacf9ee
SHA256

d6593053bda046cd96e0e5e508e0f57622c464738838b84984e35e683d46c414
SHA512

6b8dc4430f6068eaac9d27e4f322d1ae921f56b9940e266ba44ed791917c37b14bb9cb1ea3b861da36d9efe44af7acf75264e19d60a5fb1e89deabd1afa1bdbc

Score

10^/10

webmonitor backdoor infostealer rat suricata

Malware Config

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1528-69-0x000000000049D8CA-mapping.dmp	family_webmonitor
behavioral1/memory/1528-68-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/1528-71-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor

suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
suricata

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/2028-63-0x0000000000200000-0x000000000020B000-memory.dmp	CustAttr

Suspicious use of SetThreadContext 1 IoCs

Processes:

Banking_cordinates_928273.exe

description pid process target process

PID 2028 set thread context of 1528 2028 Banking_cordinates_928273.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

968 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Banking_cordinates_928273.exe

pid process

2028 Banking_cordinates_928273.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Banking_cordinates_928273.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 2028 Banking_cordinates_928273.exe
Token: SeShutdownPrivilege 1528 RegSvcs.exe

description	pid	process	target process
PID 2028 set thread context of 1528	2028	Banking_cordinates_928273.exe	RegSvcs.exe

pid	process
968	schtasks.exe

pid	process
2028	Banking_cordinates_928273.exe

description	pid	process
Token: SeDebugPrivilege	2028	Banking_cordinates_928273.exe
Token: SeShutdownPrivilege	1528	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Banking_cordinates_928273.exe

description	pid	process	target process
PID 2028 wrote to memory of 968	2028	Banking_cordinates_928273.exe	schtasks.exe
PID 2028 wrote to memory of 968	2028	Banking_cordinates_928273.exe	schtasks.exe
PID 2028 wrote to memory of 968	2028	Banking_cordinates_928273.exe	schtasks.exe
PID 2028 wrote to memory of 968	2028	Banking_cordinates_928273.exe	schtasks.exe
PID 2028 wrote to memory of 1528	2028	Banking_cordinates_928273.exe	RegSvcs.exe
PID 2028 wrote to memory of 1528	2028	Banking_cordinates_928273.exe	RegSvcs.exe
PID 2028 wrote to memory of 1528	2028	Banking_cordinates_928273.exe	RegSvcs.exe
PID 2028 wrote to memory of 1528	2028	Banking_cordinates_928273.exe	RegSvcs.exe
PID 2028 wrote to memory of 1528	2028	Banking_cordinates_928273.exe	RegSvcs.exe
PID 2028 wrote to memory of 1528	2028	Banking_cordinates_928273.exe	RegSvcs.exe
PID 2028 wrote to memory of 1528	2028	Banking_cordinates_928273.exe	RegSvcs.exe
PID 2028 wrote to memory of 1528	2028	Banking_cordinates_928273.exe	RegSvcs.exe
PID 2028 wrote to memory of 1528	2028	Banking_cordinates_928273.exe	RegSvcs.exe
PID 2028 wrote to memory of 1528	2028	Banking_cordinates_928273.exe	RegSvcs.exe
PID 2028 wrote to memory of 1528	2028	Banking_cordinates_928273.exe	RegSvcs.exe
PID 2028 wrote to memory of 1528	2028	Banking_cordinates_928273.exe	RegSvcs.exe
PID 2028 wrote to memory of 1528	2028	Banking_cordinates_928273.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Banking_cordinates_928273.exe
"C:\Users\Admin\AppData\Local\Temp\Banking_cordinates_928273.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WLmzCRrQBmjpU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB7BB.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB7BB.tmp

MD5
550ba0ca280bf477806041d2378a3f92

SHA1
986b23b30a55c05c15cfe420999b57439078506a

SHA256
72a5fd2959b4daf073ff47fe8196358fdbb8be6ba338f657231154dd62ef1540

SHA512
ab3b4b109ea6f46ad2e8d7079046f6616157814b3229c107f59e0b36ac120e6310cabf22b2bafc2b61d57e7b1995515063eec736036df2b3b9b67f4ebb52b746

Download Submit
memory/968-66-0x0000000000000000-mapping.dmp

Download
memory/1528-69-0x000000000049D8CA-mapping.dmp

Download
memory/1528-68-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1528-70-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/1528-71-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1528-72-0x0000000002E10000-0x0000000003E10000-memory.dmp

Filesize
16.0MB

Download
memory/2028-60-0x0000000001180000-0x0000000001181000-memory.dmp

Filesize
4KB

Download
memory/2028-62-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2028-63-0x0000000000200000-0x000000000020B000-memory.dmp

Filesize
44KB

Download
memory/2028-64-0x0000000005810000-0x0000000005940000-memory.dmp

Filesize
1.2MB

Download
memory/2028-65-0x0000000005A80000-0x0000000005B70000-memory.dmp

Filesize
960KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads