webmonitor | 19fddcec9add9da51ecd1e3662e55f8c8ddf9973a8babb6ecfc1df8a02c63afa

General

Target

IMAGE20210406_490133692.exe
Size

1.6MB
MD5

432494553bb7b05ce1970f180968aac3
SHA1

c1147f87babcf9c0ce3e278ded158c1343dc7e92
SHA256

ecf20ba9055ef6e87d3c8565f3eedf67f02b068c844056d7a5c1d60bb9e67e5b
SHA512

bf961ad8680d045a9a2555018695ed2e0a607feda2b60a3936be19f380985742075349d3d9112a8894f5a0c0fef2c9c668e5469ca4005ca7109bf8925b5067fd

Score

10^/10

webmonitor backdoor infostealer persistence rat

Malware Config

Extracted

Family

webmonitor

C2

saudi101.wm01.to:443

Attributes

config_key
lTAZJgwyYrKf0HlGbBwDnSIl6MwJkb96
private_key
R048cDPMf
url_path
/recv5.php

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 7 IoCs

resource	yara_rule
behavioral1/memory/1260-69-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/1260-70-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/1260-72-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/1260-76-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/1260-81-0x0000000000401000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/1768-82-0x0000000002460000-0x00000000030AA000-memory.dmp	family_webmonitor
behavioral1/memory/1904-83-0x0000000002330000-0x0000000002F7A000-memory.dmp	family_webmonitor

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral1/memory/1364-58-0x0000000000610000-0x000000000061A000-memory.dmp	CustAttr

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebMonitor-28df = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-28df.exe"	IMAGE20210406_490133692.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1364 set thread context of 1260	1364	IMAGE20210406_490133692.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1364	IMAGE20210406_490133692.exe
1364	IMAGE20210406_490133692.exe
1364	IMAGE20210406_490133692.exe
1488	powershell.exe
1904	powershell.exe
1768	powershell.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1260	IMAGE20210406_490133692.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1364	IMAGE20210406_490133692.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeShutdownPrivilege	1260	IMAGE20210406_490133692.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1488	1364	IMAGE20210406_490133692.exe	29
PID 1364 wrote to memory of 1488	1364	IMAGE20210406_490133692.exe	29
PID 1364 wrote to memory of 1488	1364	IMAGE20210406_490133692.exe	29
PID 1364 wrote to memory of 1488	1364	IMAGE20210406_490133692.exe	29
PID 1364 wrote to memory of 1904	1364	IMAGE20210406_490133692.exe	31
PID 1364 wrote to memory of 1904	1364	IMAGE20210406_490133692.exe	31
PID 1364 wrote to memory of 1904	1364	IMAGE20210406_490133692.exe	31
PID 1364 wrote to memory of 1904	1364	IMAGE20210406_490133692.exe	31
PID 1364 wrote to memory of 864	1364	IMAGE20210406_490133692.exe	33
PID 1364 wrote to memory of 864	1364	IMAGE20210406_490133692.exe	33
PID 1364 wrote to memory of 864	1364	IMAGE20210406_490133692.exe	33
PID 1364 wrote to memory of 864	1364	IMAGE20210406_490133692.exe	33
PID 1364 wrote to memory of 1768	1364	IMAGE20210406_490133692.exe	35
PID 1364 wrote to memory of 1768	1364	IMAGE20210406_490133692.exe	35
PID 1364 wrote to memory of 1768	1364	IMAGE20210406_490133692.exe	35
PID 1364 wrote to memory of 1768	1364	IMAGE20210406_490133692.exe	35
PID 1364 wrote to memory of 1260	1364	IMAGE20210406_490133692.exe	37
PID 1364 wrote to memory of 1260	1364	IMAGE20210406_490133692.exe	37
PID 1364 wrote to memory of 1260	1364	IMAGE20210406_490133692.exe	37
PID 1364 wrote to memory of 1260	1364	IMAGE20210406_490133692.exe	37
PID 1364 wrote to memory of 1260	1364	IMAGE20210406_490133692.exe	37
PID 1364 wrote to memory of 1260	1364	IMAGE20210406_490133692.exe	37
PID 1364 wrote to memory of 1260	1364	IMAGE20210406_490133692.exe	37
PID 1364 wrote to memory of 1260	1364	IMAGE20210406_490133692.exe	37
PID 1364 wrote to memory of 1260	1364	IMAGE20210406_490133692.exe	37
PID 1364 wrote to memory of 1260	1364	IMAGE20210406_490133692.exe	37

C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe
"C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nTLvOJ.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1904
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nTLvOJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp94FE.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:864
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nTLvOJ.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1768
- C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe
  "C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-69-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1260-84-0x0000000003350000-0x0000000004350000-memory.dmp

Filesize
16.0MB

Download
memory/1260-81-0x0000000000401000-0x00000000004F3000-memory.dmp

Filesize
968KB

Download
memory/1260-76-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1260-72-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1260-70-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1260-66-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1260-68-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1364-61-0x0000000007990000-0x0000000007A8E000-memory.dmp

Filesize
1016KB

Download
memory/1364-57-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/1364-60-0x0000000005350000-0x000000000544E000-memory.dmp

Filesize
1016KB

Download
memory/1364-59-0x000000007EF40000-0x000000007EFA0000-memory.dmp

Filesize
384KB

Download
memory/1364-55-0x0000000000C40000-0x0000000000DD6000-memory.dmp

Filesize
1.6MB

Download
memory/1364-58-0x0000000000610000-0x000000000061A000-memory.dmp

Filesize
40KB

Download
memory/1364-56-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1488-75-0x0000000002700000-0x000000000334A000-memory.dmp

Filesize
12.3MB

Download
memory/1488-79-0x0000000002700000-0x000000000334A000-memory.dmp

Filesize
12.3MB

Download
memory/1768-80-0x0000000002460000-0x00000000030AA000-memory.dmp

Filesize
12.3MB

Download
memory/1768-78-0x0000000002460000-0x00000000030AA000-memory.dmp

Filesize
12.3MB

Download
memory/1768-82-0x0000000002460000-0x00000000030AA000-memory.dmp

Filesize
12.3MB

Download
memory/1904-83-0x0000000002330000-0x0000000002F7A000-memory.dmp

Filesize
12.3MB

Download
memory/1904-77-0x0000000002330000-0x0000000002F7A000-memory.dmp

Filesize
12.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads