webmonitor | 23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291

General

Target

23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
Size

1.6MB
MD5

4ad2d9ba4a521a8b2b384ffdc05bb11b
SHA1

78090aae744b92d4064f144fd934e1dc217f4f97
SHA256

23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291
SHA512

90058d6792525d885f3dd20dc09ff06c5043106897c886d15eb794023e254734aa23220e74a028ec97755e18db8a4b1c259413b9cc6059848e078726846d0412

Score

10^/10

webmonitor backdoor infostealer rat upx

Malware Config

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1484-69-0x0000000000400000-0x00000000005F7000-memory.dmp	family_webmonitor
behavioral1/memory/1484-70-0x0000000000400000-0x00000000005F7000-memory.dmp	family_webmonitor
behavioral1/memory/1484-72-0x0000000002E50000-0x0000000003E50000-memory.dmp	family_webmonitor

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1484-62-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1484-64-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1484-66-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1484-67-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1484-68-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1484-69-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1484-70-0x0000000000400000-0x00000000005F7000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1596 set thread context of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
528	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
Token: SeDebugPrivilege	1484	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
Token: SeShutdownPrivilege	1484	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 528	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	29
PID 1596 wrote to memory of 528	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	29
PID 1596 wrote to memory of 528	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	29
PID 1596 wrote to memory of 528	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	29
PID 1596 wrote to memory of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	31
PID 1596 wrote to memory of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	31
PID 1596 wrote to memory of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	31
PID 1596 wrote to memory of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	31
PID 1596 wrote to memory of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	31
PID 1596 wrote to memory of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	31
PID 1596 wrote to memory of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	31
PID 1596 wrote to memory of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	31

C:\Users\Admin\AppData\Local\Temp\23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
"C:\Users\Admin\AppData\Local\Temp\23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XnIVGmT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2626.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:528
- C:\Users\Admin\AppData\Local\Temp\23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1484-69-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1484-68-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1484-72-0x0000000002E50000-0x0000000003E50000-memory.dmp

Filesize
16.0MB

Download
memory/1484-71-0x0000000074C61000-0x0000000074C63000-memory.dmp

Filesize
8KB

Download
memory/1484-70-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1484-60-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1484-64-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1484-66-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1484-62-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1484-67-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1596-56-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/1596-54-0x0000000000FA0000-0x0000000001148000-memory.dmp

Filesize
1.7MB

Download
memory/1596-55-0x00000000740C0000-0x00000000747AE000-memory.dmp

Filesize
6.9MB

Download
memory/1596-58-0x00000000085E0000-0x0000000008722000-memory.dmp

Filesize
1.3MB

Download
memory/1596-57-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads