Overview

overview

10

Static

static

IMAGE20210...92.exe

windows7_x64

10

IMAGE20210...92.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    19fddcec9add9da51ecd1e3662e55f8c8ddf9973a8babb6ecfc1df8a02c63afa

  • Size

    1.3MB

  • Sample

    220205-qzpz2abhd7

  • MD5

    730903458642e948f4a02142ae0981b2

  • SHA1

    5571cf04008fae84d2f8f9a6e927cb99bba42e0d

  • SHA256

    19fddcec9add9da51ecd1e3662e55f8c8ddf9973a8babb6ecfc1df8a02c63afa

  • SHA512

    b9c9d2e801d7a3bb0dac90e40ab452cfef28d0d7311c39832f3e89091733b16410e9930d2dde7cb0eb147615c8b0695e4f57201bfff5498b3dfb0629e39ecaaa

Score
10/10
webmonitorbackdoorinfostealerpersistencerat

Malware Config

Extracted

Family

webmonitor

C2

saudi101.wm01.to:443

Attributes
  • config_key

    lTAZJgwyYrKf0HlGbBwDnSIl6MwJkb96

  • private_key

    R048cDPMf

  • url_path

    /recv5.php

Targets

    • Target

      IMAGE20210406_490133692.exe

    • Size

      1.6MB

    • MD5

      432494553bb7b05ce1970f180968aac3

    • SHA1

      c1147f87babcf9c0ce3e278ded158c1343dc7e92

    • SHA256

      ecf20ba9055ef6e87d3c8565f3eedf67f02b068c844056d7a5c1d60bb9e67e5b

    • SHA512

      bf961ad8680d045a9a2555018695ed2e0a607feda2b60a3936be19f380985742075349d3d9112a8894f5a0c0fef2c9c668e5469ca4005ca7109bf8925b5067fd

    Score
    10/10
    webmonitorbackdoorinfostealerpersistencerat

    • RevcodeRat, WebMonitorRat

      WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

      backdoorratinfostealerwebmonitor

    • WebMonitor Payload

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks