Overview

overview

10

Static

static

PREVIOUS C...df.exe

windows7_x64

10

PREVIOUS C...df.exe

windows10_x64

10

Analysis

  • max time kernel
    144s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    06-12-2021 11:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PREVIOUS CONVERSATION.pdf.exe

  • Size

    2.2MB

  • MD5

    28241aafe5b6018c984e310c33e9e48b

  • SHA1

    d126c0cf51a98d9f3bd38efa6e61d4091104c624

  • SHA256

    9e6563c2c5e8a869bfdbf4ff1336bf2abcd238695d87f79a01b308216acc9cb5

  • SHA512

    730ae328d0cc82be717d24130073d8a3d0ec8e3b118e88dcb2b13071499c2efa03cf98905be68b2bc041a3245d792a113403272f67052963f3c4baeae15d0c98

Score
10/10
webmonitorbackdoorinfostealerrat

Malware Config

Extracted

Family

webmonitor

C2

niiarmah.wm01.to:443

Attributes
  • config_key

    4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O

  • private_key

    yvkn5wM8E

  • url_path

    /recv5.php

Signatures

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

    backdoorratinfostealerwebmonitor
  • WebMonitor Payload 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PREVIOUS CONVERSATION.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\PREVIOUS CONVERSATION.pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:840
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\FeqVzOoxhxw.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:112
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FeqVzOoxhxw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEDA9.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:752
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
        PID:1360
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1960

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpEDA9.tmp
      MD5

      bab7d36ccab22eab4406c0792da2dc63

      SHA1

      27745d4d1824a3be5bf8de06e74bce81f34be343

      SHA256

      6090b3610e7ec7c38c31ec35b67623384e94d0915f0db514b2748febf982feb9

      SHA512

      fd16de367cf45188f827b84c5c6a221f28d5870ec29e510e598c9ee56f28d7184303f119e655ccd70b74748beb6d89c878a9884ba336f2016f5685a6978f7aa3

      Download Submit
    • memory/112-72-0x00000000023C0000-0x000000000300A000-memory.dmp
      Filesize

      12.3MB

      Download
    • memory/112-61-0x0000000000000000-mapping.dmp
      Download
    • memory/112-75-0x00000000023C0000-0x000000000300A000-memory.dmp
      Filesize

      12.3MB

      Download
    • memory/112-76-0x00000000023C0000-0x000000000300A000-memory.dmp
      Filesize

      12.3MB

      Download
    • memory/752-63-0x0000000000000000-mapping.dmp
      Download
    • memory/840-57-0x0000000075191000-0x0000000075193000-memory.dmp
      Filesize

      8KB

      Download
    • memory/840-58-0x0000000004F50000-0x0000000004F51000-memory.dmp
      Filesize

      4KB

      Download
    • memory/840-59-0x0000000000270000-0x0000000000278000-memory.dmp
      Filesize

      32KB

      Download
    • memory/840-60-0x0000000005730000-0x000000000594C000-memory.dmp
      Filesize

      2.1MB

      Download
    • memory/840-55-0x0000000000EF0000-0x0000000000EF1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1960-65-0x0000000000400000-0x00000000004F3000-memory.dmp
      Filesize

      972KB

      Download
    • memory/1960-69-0x0000000000400000-0x00000000004F3000-memory.dmp
      Filesize

      972KB

      Download
    • memory/1960-68-0x0000000000400000-0x00000000004F3000-memory.dmp
      Filesize

      972KB

      Download
    • memory/1960-71-0x000000000049D8CA-mapping.dmp
      Download
    • memory/1960-66-0x0000000000400000-0x00000000004F3000-memory.dmp
      Filesize

      972KB

      Download
    • memory/1960-67-0x0000000000400000-0x00000000004F3000-memory.dmp
      Filesize

      972KB

      Download
    • memory/1960-74-0x0000000000400000-0x00000000004F3000-memory.dmp
      Filesize

      972KB

      Download
    • memory/1960-77-0x00000000030C0000-0x00000000040C0000-memory.dmp
      Filesize

      16.0MB

      Download