webmonitor | 23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291

General

Target

23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
Size

1.6MB
MD5

4ad2d9ba4a521a8b2b384ffdc05bb11b
SHA1

78090aae744b92d4064f144fd934e1dc217f4f97
SHA256

23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291
SHA512

90058d6792525d885f3dd20dc09ff06c5043106897c886d15eb794023e254734aa23220e74a028ec97755e18db8a4b1c259413b9cc6059848e078726846d0412

Score

10^/10

webmonitor backdoor infostealer rat upx

Malware Config

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1484-69-0x0000000000400000-0x00000000005F7000-memory.dmp	family_webmonitor
behavioral1/memory/1484-70-0x0000000000400000-0x00000000005F7000-memory.dmp	family_webmonitor
behavioral1/memory/1484-72-0x0000000002E50000-0x0000000003E50000-memory.dmp	family_webmonitor

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1484-62-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1484-64-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1484-66-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1484-67-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1484-68-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1484-69-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral1/memory/1484-70-0x0000000000400000-0x00000000005F7000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

description	pid	process	target process
PID 1596 set thread context of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

528 schtasks.exe

pid	process
528	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

description	pid	process
Token: SeDebugPrivilege	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
Token: SeDebugPrivilege	1484	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
Token: SeShutdownPrivilege	1484	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

description	pid	process	target process
PID 1596 wrote to memory of 528	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	schtasks.exe
PID 1596 wrote to memory of 528	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	schtasks.exe
PID 1596 wrote to memory of 528	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	schtasks.exe
PID 1596 wrote to memory of 528	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	schtasks.exe
PID 1596 wrote to memory of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
PID 1596 wrote to memory of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
PID 1596 wrote to memory of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
PID 1596 wrote to memory of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
PID 1596 wrote to memory of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
PID 1596 wrote to memory of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
PID 1596 wrote to memory of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
PID 1596 wrote to memory of 1484	1596	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

C:\Users\Admin\AppData\Local\Temp\23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
"C:\Users\Admin\AppData\Local\Temp\23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XnIVGmT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2626.tmp"
2⤵
- Creates scheduled task(s)
PID:528

C:\Users\Admin\AppData\Local\Temp\23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1484

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2626.tmp
MD5
dde9b5ba6280005fc77c97cb73621942

SHA1
067834d1e5f401db2f6a60291b31465f9d033eb2

SHA256
d39e31b675cfdfdd7ea7bc81716f4a4a463a036f5117a3382a4cabc744c72d95

SHA512
a19ab6d179b197bd71769e21ec04d2e4c6208ef6ec60b5b94c917d9789a6e806e8a420b598a4d33361a22d3adb1adf5465f8280c0c681f62fffaf2886abbbebd

Download Submit
memory/1484-69-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1484-68-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1484-72-0x0000000002E50000-0x0000000003E50000-memory.dmp

Filesize
16.0MB

Download
memory/1484-71-0x0000000074C61000-0x0000000074C63000-memory.dmp

Filesize
8KB

Download
memory/1484-70-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1484-60-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1484-64-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1484-66-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1484-62-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1484-67-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1596-56-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/1596-54-0x0000000000FA0000-0x0000000001148000-memory.dmp

Filesize
1.7MB

Download
memory/1596-55-0x00000000740C0000-0x00000000747AE000-memory.dmp

Filesize
6.9MB

Download
memory/1596-58-0x00000000085E0000-0x0000000008722000-memory.dmp

Filesize
1.3MB

Download
memory/1596-57-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads