webmonitor | 2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f

General

Target

2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe
Size

664KB
MD5

d70e0374668e637143033871c188e611
SHA1

b139aae87bbebce9b4f30b34488e5725e5f2d9f4
SHA256

2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f
SHA512

c76e5c47dff15dcdf65504d85bbdb59292be24ba3d9eadb6ac4f191fc87b41769854a4e1a4bf7c7478ca433ed36b4245def44b7dc9176baaf3f7163c8495756d

Score

10^/10

webmonitor backdoor infostealer persistence rat suricata

Malware Config

Extracted

Family

webmonitor

C2

mukor.wm01.to:443

Attributes

config_key
zOjouFvoVpF6QWsmVHlIAw7Ge07Wx6SW
private_key
dOhdo7byI
url_path
/recv5.php

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1388-61-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/1388-62-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/1388-63-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/1388-66-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/1388-67-0x0000000003170000-0x0000000004170000-memory.dmp	family_webmonitor

suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
suricata

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebMonitor-0740 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-0740.exe"	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe

description	pid	process	target process
PID 1340 set thread context of 1388	1340	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe

pid process

1340 2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe

pid process

1388 2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe

pid	process
1340	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe

pid	process
1388	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe

description	pid	process
Token: SeDebugPrivilege	1340	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe
Token: SeShutdownPrivilege	1388	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe

description	pid	process	target process
PID 1340 wrote to memory of 1388	1340	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe
PID 1340 wrote to memory of 1388	1340	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe
PID 1340 wrote to memory of 1388	1340	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe
PID 1340 wrote to memory of 1388	1340	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe
PID 1340 wrote to memory of 1388	1340	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe
PID 1340 wrote to memory of 1388	1340	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe
PID 1340 wrote to memory of 1388	1340	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe
PID 1340 wrote to memory of 1388	1340	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe
PID 1340 wrote to memory of 1388	1340	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe
PID 1340 wrote to memory of 1388	1340	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe	2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe

C:\Users\Admin\AppData\Local\Temp\2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe
"C:\Users\Admin\AppData\Local\Temp\2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Users\Admin\AppData\Local\Temp\2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe
  C:\Users\Admin\AppData\Local\Temp\2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-53-0x0000000001170000-0x000000000121C000-memory.dmp

Filesize
688KB

Download
memory/1340-54-0x0000000074C3E000-0x0000000074C3F000-memory.dmp

Filesize
4KB

Download
memory/1340-55-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1340-56-0x00000000002D0000-0x00000000002D8000-memory.dmp

Filesize
32KB

Download
memory/1340-57-0x0000000000245000-0x0000000000256000-memory.dmp

Filesize
68KB

Download
memory/1340-58-0x00000000004A0000-0x00000000004DE000-memory.dmp

Filesize
248KB

Download
memory/1388-59-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1388-60-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1388-61-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1388-62-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1388-63-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1388-65-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Filesize
8KB

Download
memory/1388-66-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1388-67-0x0000000003170000-0x0000000004170000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads