webmonitor | 8246f2b18a1592cc2a37c001e2415412f5e63d14220324ae8356981e25a4ba76

Analysis

max time kernel
151s
max time network
142s
platform
windows7_x64
resource
win7-en-20211208
submitted
05-02-2022 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8246f2b18a1592cc2a37c001e2415412f5e63d14220324ae8356981e25a4ba76.exe
Size

365KB
MD5

57217eb6e20111a0c920ad0da2d77818
SHA1

2af513372e7bae653c2942effdc068a73fa72717
SHA256

8246f2b18a1592cc2a37c001e2415412f5e63d14220324ae8356981e25a4ba76
SHA512

92d7119dd19b366ead9e5c56fe4e4e0a70dd0a2e8a3c49925d6001be5ab509c5ab5d880e31d2d3460880f9ffb06a79a1fda5c5275dc63e0bf16ddef501020051

Score

10^/10

webmonitor backdoor infostealer persistence rat

Malware Config

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8246f2b18a1592cc2a37c001e2415412f5e63d14220324ae8356981e25a4ba76.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebMonitor-28df = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-28df.exe"	8246f2b18a1592cc2a37c001e2415412f5e63d14220324ae8356981e25a4ba76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WebMonitor-28df = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-28df.exe"	8246f2b18a1592cc2a37c001e2415412f5e63d14220324ae8356981e25a4ba76.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

8246f2b18a1592cc2a37c001e2415412f5e63d14220324ae8356981e25a4ba76.exe

pid process

1228 8246f2b18a1592cc2a37c001e2415412f5e63d14220324ae8356981e25a4ba76.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8246f2b18a1592cc2a37c001e2415412f5e63d14220324ae8356981e25a4ba76.exe

description pid process

Token: SeShutdownPrivilege 1228 8246f2b18a1592cc2a37c001e2415412f5e63d14220324ae8356981e25a4ba76.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

8246f2b18a1592cc2a37c001e2415412f5e63d14220324ae8356981e25a4ba76.exe

pid process

1228 8246f2b18a1592cc2a37c001e2415412f5e63d14220324ae8356981e25a4ba76.exe

pid	process
1228	8246f2b18a1592cc2a37c001e2415412f5e63d14220324ae8356981e25a4ba76.exe

description	pid	process
Token: SeShutdownPrivilege	1228	8246f2b18a1592cc2a37c001e2415412f5e63d14220324ae8356981e25a4ba76.exe

pid	process
1228	8246f2b18a1592cc2a37c001e2415412f5e63d14220324ae8356981e25a4ba76.exe

C:\Users\Admin\AppData\Local\Temp\8246f2b18a1592cc2a37c001e2415412f5e63d14220324ae8356981e25a4ba76.exe
"C:\Users\Admin\AppData\Local\Temp\8246f2b18a1592cc2a37c001e2415412f5e63d14220324ae8356981e25a4ba76.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-54-0x00000000758A1000-0x00000000758A3000-memory.dmp

Filesize
8KB

Download