webmonitor | 28fd0fcdf202f29eaaee33d23939cd5bdd75bd68ee4c7815d4ca4dd2e6a04be5

General

Target

OUTSTANDING_DEBTS.exe
Size

1.3MB
MD5

a0cb248c9464e9ea4f72ebc7d7807e98
SHA1

d049bc23f0604897e32ac0f76f52677a7c8ce991
SHA256

28fd0fcdf202f29eaaee33d23939cd5bdd75bd68ee4c7815d4ca4dd2e6a04be5
SHA512

4849ad39e130e6513ba56d5a23eae54c73f3f7436ff3a289ebc93ab5106bb9ba56f8b58d543b94576c07ff3c79991e9f3a7f85ad84d9ac4d0317dde2b83dce2c

Score

10^/10

webmonitor backdoor infostealer rat

Malware Config

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3428-118-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor

Suspicious use of SetThreadContext 1 IoCs

Processes:

OUTSTANDING_DEBTS.exe

description pid process target process

PID 740 set thread context of 3428 740 OUTSTANDING_DEBTS.exe OUTSTANDING_DEBTS.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

OUTSTANDING_DEBTS.exe

pid process

740 OUTSTANDING_DEBTS.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

OUTSTANDING_DEBTS.exe

pid process

3428 OUTSTANDING_DEBTS.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

OUTSTANDING_DEBTS.exe

description pid process

Token: SeShutdownPrivilege 3428 OUTSTANDING_DEBTS.exe
Token: SeCreatePagefilePrivilege 3428 OUTSTANDING_DEBTS.exe

description	pid	process	target process
PID 740 set thread context of 3428	740	OUTSTANDING_DEBTS.exe	OUTSTANDING_DEBTS.exe

pid	process
740	OUTSTANDING_DEBTS.exe

pid	process
3428	OUTSTANDING_DEBTS.exe

description	pid	process
Token: SeShutdownPrivilege	3428	OUTSTANDING_DEBTS.exe
Token: SeCreatePagefilePrivilege	3428	OUTSTANDING_DEBTS.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

OUTSTANDING_DEBTS.exeOUTSTANDING_DEBTS.exe

description	pid	process	target process
PID 740 wrote to memory of 3428	740	OUTSTANDING_DEBTS.exe	OUTSTANDING_DEBTS.exe
PID 740 wrote to memory of 3428	740	OUTSTANDING_DEBTS.exe	OUTSTANDING_DEBTS.exe
PID 740 wrote to memory of 3428	740	OUTSTANDING_DEBTS.exe	OUTSTANDING_DEBTS.exe
PID 740 wrote to memory of 3428	740	OUTSTANDING_DEBTS.exe	OUTSTANDING_DEBTS.exe
PID 3428 wrote to memory of 640	3428	OUTSTANDING_DEBTS.exe	cmd.exe
PID 3428 wrote to memory of 640	3428	OUTSTANDING_DEBTS.exe	cmd.exe
PID 3428 wrote to memory of 640	3428	OUTSTANDING_DEBTS.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\OUTSTANDING_DEBTS.exe
"C:\Users\Admin\AppData\Local\Temp\OUTSTANDING_DEBTS.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:740

C:\Users\Admin\AppData\Local\Temp\OUTSTANDING_DEBTS.exe
"C:\Users\Admin\AppData\Local\Temp\OUTSTANDING_DEBTS.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pMeFP78DnDjr2cxk.bat" "
3⤵
PID:640

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pMeFP78DnDjr2cxk.bat
MD5
4a75b5ab5ee00e005bf8f0448b66f6a8

SHA1
5fdb3b05fcb31ee4c9fc1c6175bbf49e02eb5217

SHA256
5299fca7ea2004fe5a9964d324a2483ccb9c6b3f07efe5568a7fd06d9d3849f1

SHA512
b4ab7ac397ddd1a7b6db22bca11ed0fa88314e5088e0cd48014e37421898b1f5d19ac8f7b7bfb9a82a847a9904437cd4aefcee8e5496d0124638330704253e3b

Download Submit
memory/640-119-0x0000000000000000-mapping.dmp

Download
memory/740-117-0x0000000003190000-0x0000000003192000-memory.dmp

Filesize
8KB

Download
memory/3428-114-0x000000000049D8CA-mapping.dmp

Download
memory/3428-118-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download

Analysis

Sharing