webmonitor | 23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291

General

Target

23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
Size

1.6MB
MD5

4ad2d9ba4a521a8b2b384ffdc05bb11b
SHA1

78090aae744b92d4064f144fd934e1dc217f4f97
SHA256

23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291
SHA512

90058d6792525d885f3dd20dc09ff06c5043106897c886d15eb794023e254734aa23220e74a028ec97755e18db8a4b1c259413b9cc6059848e078726846d0412

Score

10^/10

webmonitor backdoor infostealer rat upx

Malware Config

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2632-142-0x0000000000400000-0x00000000005F7000-memory.dmp	family_webmonitor
behavioral2/memory/2632-141-0x0000000000400000-0x00000000005F7000-memory.dmp	family_webmonitor

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2632-139-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral2/memory/2632-138-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral2/memory/2632-140-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral2/memory/2632-142-0x0000000000400000-0x00000000005F7000-memory.dmp	upx
behavioral2/memory/2632-141-0x0000000000400000-0x00000000005F7000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

description	pid	process	target process
PID 2644 set thread context of 2632	2644	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1492 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

pid process

2644 23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

pid	process
1492	schtasks.exe

pid	process
2644	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

description	pid	process
Token: SeDebugPrivilege	2644	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
Token: SeDebugPrivilege	2632	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
Token: SeShutdownPrivilege	2632	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
Token: SeCreatePagefilePrivilege	2632	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

description	pid	process	target process
PID 2644 wrote to memory of 1492	2644	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	schtasks.exe
PID 2644 wrote to memory of 1492	2644	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	schtasks.exe
PID 2644 wrote to memory of 1492	2644	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	schtasks.exe
PID 2644 wrote to memory of 2632	2644	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
PID 2644 wrote to memory of 2632	2644	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
PID 2644 wrote to memory of 2632	2644	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
PID 2644 wrote to memory of 2632	2644	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
PID 2644 wrote to memory of 2632	2644	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
PID 2644 wrote to memory of 2632	2644	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
PID 2644 wrote to memory of 2632	2644	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe	23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe

C:\Users\Admin\AppData\Local\Temp\23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
"C:\Users\Admin\AppData\Local\Temp\23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XnIVGmT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp35BE.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1492
- C:\Users\Admin\AppData\Local\Temp\23b85462863143f527065ecde8e2bcbc15c649006af98ec57e1ea44b22fdf291.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp35BE.tmp

MD5
6a03355232bda11f348f6ed1db04a177

SHA1
d7e3aad94b464198241218adefb82ae1ed62f940

SHA256
c50e804811f5d0bd1f464a8ad7891aac3c5d876f6b7a65f66a68799d252948a7

SHA512
0e7c01548fab616eab71f3fa70648a92bb87399de20ebd59a812b43a423e877afcd168524a67291a3fa7ae0e8cbd482e51aeb966bef149aa6cef16bf755a2775

Download Submit
memory/2632-143-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/2632-141-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2632-142-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2632-140-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2632-138-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2632-139-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2644-133-0x0000000074B60000-0x0000000075310000-memory.dmp

Filesize
7.7MB

Download
memory/2644-136-0x00000000084F0000-0x000000000858C000-memory.dmp

Filesize
624KB

Download
memory/2644-135-0x0000000004CC0000-0x0000000004CCA000-memory.dmp

Filesize
40KB

Download
memory/2644-134-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/2644-130-0x0000000000160000-0x0000000000308000-memory.dmp

Filesize
1.7MB

Download
memory/2644-132-0x0000000004D30000-0x0000000004DC2000-memory.dmp

Filesize
584KB

Download
memory/2644-131-0x00000000053D0000-0x0000000005974000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads