webmonitor | 507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43

General

Target

507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe
Size

1.6MB
MD5

c1cddcc1f4a9d2317dcffdec3c503e9b
SHA1

b17df4c1827e9f52addc193b6579ffdd51a58f54
SHA256

507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43
SHA512

7d3a27590785366f03cb08ae7df255a38a6e2715dfcb321f5586f906e787fcac9ff2bc3256e4cddbae6915cd04cbf4a85411371dbed000776c4259d85447c392

Score

10^/10

webmonitor backdoor infostealer rat upx

Malware Config

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1160-69-0x0000000000400000-0x00000000005F7000-memory.dmp	family_webmonitor
behavioral1/memory/1160-70-0x0000000000400000-0x00000000005F7000-memory.dmp	family_webmonitor

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1160-62-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1160-64-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1160-66-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1160-67-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1160-68-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1160-69-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1160-70-0x0000000000400000-0x00000000005F7000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe

description	pid	process	target process
PID 1104 set thread context of 1160	1104	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1920 schtasks.exe

pid	process
1920	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe

description	pid	process
Token: SeDebugPrivilege	1104	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe
Token: SeDebugPrivilege	1160	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe
Token: SeShutdownPrivilege	1160	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe

description	pid	process	target process
PID 1104 wrote to memory of 1920	1104	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe	schtasks.exe
PID 1104 wrote to memory of 1920	1104	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe	schtasks.exe
PID 1104 wrote to memory of 1920	1104	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe	schtasks.exe
PID 1104 wrote to memory of 1920	1104	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe	schtasks.exe
PID 1104 wrote to memory of 1160	1104	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe
PID 1104 wrote to memory of 1160	1104	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe
PID 1104 wrote to memory of 1160	1104	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe
PID 1104 wrote to memory of 1160	1104	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe
PID 1104 wrote to memory of 1160	1104	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe
PID 1104 wrote to memory of 1160	1104	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe
PID 1104 wrote to memory of 1160	1104	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe
PID 1104 wrote to memory of 1160	1104	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe	507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe

C:\Users\Admin\AppData\Local\Temp\507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe
"C:\Users\Admin\AppData\Local\Temp\507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WQszvOfdvRK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1AA2.tmp"
2⤵
- Creates scheduled task(s)
PID:1920

C:\Users\Admin\AppData\Local\Temp\507c0c882aab3118a5cfb52a0f613a1c82f168db7b8f2e5b5ab3721b5bf4df43.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1160

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1AA2.tmp
MD5
1f1d7c4d7f840dfd7cbda325044a1969

SHA1
e24df57819da90a4c1964ef507c256eea58cc95c

SHA256
d8455008d7db758aab6b68d74cba58ae84775a48974df6d2d3ee7526ae2d2ab3

SHA512
c2d7189b11ae0d4695307c3ceffe851b9060e5713ee666d5645b267296d54222e6417dbc6bfaafa19244730f3d95f988d2d225022896f193f85359d6c2461b35

Download Submit
memory/1104-54-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/1104-55-0x0000000001350000-0x00000000014F2000-memory.dmp

Filesize
1.6MB

Download
memory/1104-56-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/1104-57-0x00000000002E0000-0x00000000002EA000-memory.dmp

Filesize
40KB

Download
memory/1104-58-0x0000000008270000-0x00000000083AE000-memory.dmp

Filesize
1.2MB

Download
memory/1160-64-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1160-62-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1160-60-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1160-66-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1160-67-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1160-68-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1160-69-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1160-70-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1160-71-0x0000000074F31000-0x0000000074F33000-memory.dmp

Filesize
8KB

Download
memory/1160-72-0x0000000002EB0000-0x0000000003EB0000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads