Analysis

  • max time kernel
    120s
  • max time network
    110s
  • platform
    windows7_x64
  • resource
    win7-ja-20210920
  • submitted
    25-09-2021 06:18

General

  • Target

    9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe

  • Size

    360KB

  • MD5

    6e223f8e362245614a74d9865d0817b0

  • SHA1

    dd8d9ea9d62bcf6a7e69bbf6dd81457103bcc29e

  • SHA256

    9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e

  • SHA512

    36321cbe8c9b17a939241247baa27e204f51c2f8c8667cafd3ddd939159412ead8addf663b2285499396917f1bebe51cc9f1ec7c218645f877860010da5c4e1a

Malware Config

Signatures

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

  • WebMonitor Payload 1 IoCs
  • suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

    suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe
    "C:\Users\Admin\AppData\Local\Temp\9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1560
    • C:\Users\Admin\AppData\Local\Temp\9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe
      "C:\Users\Admin\AppData\Local\Temp\9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: RenamesItself
      PID:1760

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe

    MD5

    6e223f8e362245614a74d9865d0817b0

    SHA1

    dd8d9ea9d62bcf6a7e69bbf6dd81457103bcc29e

    SHA256

    9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e

    SHA512

    36321cbe8c9b17a939241247baa27e204f51c2f8c8667cafd3ddd939159412ead8addf663b2285499396917f1bebe51cc9f1ec7c218645f877860010da5c4e1a

  • \Users\Admin\AppData\Local\Temp\9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe

    MD5

    6e223f8e362245614a74d9865d0817b0

    SHA1

    dd8d9ea9d62bcf6a7e69bbf6dd81457103bcc29e

    SHA256

    9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e

    SHA512

    36321cbe8c9b17a939241247baa27e204f51c2f8c8667cafd3ddd939159412ead8addf663b2285499396917f1bebe51cc9f1ec7c218645f877860010da5c4e1a

  • memory/1560-53-0x00000000000B0000-0x00000000000B1000-memory.dmp

    Filesize

    4KB

  • memory/1560-55-0x0000000000320000-0x0000000000322000-memory.dmp

    Filesize

    8KB

  • memory/1560-60-0x0000000004940000-0x0000000004941000-memory.dmp

    Filesize

    4KB

  • memory/1760-57-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/1760-58-0x00000000004BE2B0-mapping.dmp

  • memory/1760-61-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/1760-62-0x0000000075741000-0x0000000075743000-memory.dmp

    Filesize

    8KB