webmonitor | 1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f

Analysis

max time kernel
153s
max time network
174s
platform
windows7_x64
resource
win7-en-20211208
submitted
06-02-2022 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe
Size

365KB
MD5

1ad8e8ffcb516c05d9a882f0e9902a3c
SHA1

19e98c4c807391a97ee58b83a99c476e2129fde3
SHA256

1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f
SHA512

eb291f57c95dfa3a96f1637a30ec401b5959694f5000546ad7cd687f2f5c05bf6746d1c449cb660a8ff8dff32c30e28e3e1fc57184ab5b97bc9422122f3e12c3

Score

10^/10

webmonitor backdoor infostealer persistence rat suricata

Malware Config

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
suricata

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebMonitor-28df = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-28df.exe"	1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
840	1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	840	1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe

C:\Users\Admin\AppData\Local\Temp\1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe
"C:\Users\Admin\AppData\Local\Temp\1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-55-0x0000000076371000-0x0000000076373000-memory.dmp

Filesize
8KB

Download