webmonitor | 28fd0fcdf202f29eaaee33d23939cd5bdd75bd68ee4c7815d4ca4dd2e6a04be5

Analysis

max time kernel
150s
max time network
200s
platform
windows7_x64
resource
win7v20210408
submitted
16-08-2021 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OUTSTANDING_DEBTS.exe
Size

1.3MB
MD5

a0cb248c9464e9ea4f72ebc7d7807e98
SHA1

d049bc23f0604897e32ac0f76f52677a7c8ce991
SHA256

28fd0fcdf202f29eaaee33d23939cd5bdd75bd68ee4c7815d4ca4dd2e6a04be5
SHA512

4849ad39e130e6513ba56d5a23eae54c73f3f7436ff3a289ebc93ab5106bb9ba56f8b58d543b94576c07ff3c79991e9f3a7f85ad84d9ac4d0317dde2b83dce2c

Score

10^/10

webmonitor backdoor infostealer persistence rat suricata

Malware Config

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1404-62-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor

suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
suricata

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WebMonitor-ced9 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-ced9.exe"	OUTSTANDING_DEBTS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebMonitor-ced9 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-ced9.exe"	OUTSTANDING_DEBTS.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 628 set thread context of 1404	628	OUTSTANDING_DEBTS.exe	29

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
628	OUTSTANDING_DEBTS.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1404	OUTSTANDING_DEBTS.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1404	OUTSTANDING_DEBTS.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 1404	628	OUTSTANDING_DEBTS.exe	29
PID 628 wrote to memory of 1404	628	OUTSTANDING_DEBTS.exe	29
PID 628 wrote to memory of 1404	628	OUTSTANDING_DEBTS.exe	29
PID 628 wrote to memory of 1404	628	OUTSTANDING_DEBTS.exe	29
PID 628 wrote to memory of 1404	628	OUTSTANDING_DEBTS.exe	29

C:\Users\Admin\AppData\Local\Temp\OUTSTANDING_DEBTS.exe
"C:\Users\Admin\AppData\Local\Temp\OUTSTANDING_DEBTS.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:628
- C:\Users\Admin\AppData\Local\Temp\OUTSTANDING_DEBTS.exe
  "C:\Users\Admin\AppData\Local\Temp\OUTSTANDING_DEBTS.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-61-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/1404-60-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/1404-62-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1404-63-0x0000000003090000-0x0000000004090000-memory.dmp

Filesize
16.0MB

Download