Analysis
-
max time kernel
4294208s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
20-03-2022 01:26
Static task
static1
Behavioral task
behavioral1
Sample
04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe
Resource
win10v2004-20220310-en
General
-
Target
04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe
-
Size
1.6MB
-
MD5
c5ef92f3ee5dd058aee7acc24617dc75
-
SHA1
335b2cbb898146725bb81af4ca254971e1301e2f
-
SHA256
04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae
-
SHA512
9d4b10ceee22ac0eb59d6e7bc94f26a4bf6faff91306af370f6cb31f62d2eb28541de1c0f32d584ad1e1598417c94a75720fc0043e2c822e7fbba1f60f1b6bdd
Malware Config
Signatures
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1796-69-0x0000000000400000-0x00000000005F7000-memory.dmp family_webmonitor behavioral1/memory/1796-70-0x0000000000400000-0x00000000005F7000-memory.dmp family_webmonitor behavioral1/memory/1796-72-0x0000000002E10000-0x0000000003E10000-memory.dmp family_webmonitor -
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Processes:
resource yara_rule behavioral1/memory/1796-62-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral1/memory/1796-64-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral1/memory/1796-66-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral1/memory/1796-67-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral1/memory/1796-68-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral1/memory/1796-69-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral1/memory/1796-70-0x0000000000400000-0x00000000005F7000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exedescription pid process target process PID 964 set thread context of 1796 964 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exedescription pid process Token: SeDebugPrivilege 1796 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe Token: SeShutdownPrivilege 1796 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exedescription pid process target process PID 964 wrote to memory of 1832 964 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe schtasks.exe PID 964 wrote to memory of 1832 964 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe schtasks.exe PID 964 wrote to memory of 1832 964 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe schtasks.exe PID 964 wrote to memory of 1832 964 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe schtasks.exe PID 964 wrote to memory of 1796 964 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe PID 964 wrote to memory of 1796 964 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe PID 964 wrote to memory of 1796 964 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe PID 964 wrote to memory of 1796 964 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe PID 964 wrote to memory of 1796 964 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe PID 964 wrote to memory of 1796 964 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe PID 964 wrote to memory of 1796 964 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe PID 964 wrote to memory of 1796 964 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe 04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe"C:\Users\Admin\AppData\Local\Temp\04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\auFtTukBq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEC81.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\04ca9c3b628ea6dad9416c02c1b49af193644b406cd6aba37d933df0e73ce9ae.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpEC81.tmpMD5
196727143cce2890550e4298713e77f2
SHA1047275c342b7118583630ebde9b313d800af2c61
SHA256852cb503e34f50ebc29259723471b9435ac8ada21d2af1cf53fb113577f6f6da
SHA512d8a37a22ae9fcf86b1970c783e492d1f1e81077b5220e73a39972bdef46f7dc9daf71e19d93052492c13c76f96358ebc863ece0b0088109b3280766ea232b9ea
-
memory/964-54-0x00000000009C0000-0x0000000000B62000-memory.dmpFilesize
1.6MB
-
memory/964-55-0x0000000074CD0000-0x00000000753BE000-memory.dmpFilesize
6.9MB
-
memory/964-56-0x0000000000920000-0x0000000000921000-memory.dmpFilesize
4KB
-
memory/964-57-0x0000000000960000-0x000000000096A000-memory.dmpFilesize
40KB
-
memory/964-58-0x0000000008120000-0x000000000825C000-memory.dmpFilesize
1.2MB
-
memory/1796-64-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/1796-62-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/1796-60-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/1796-66-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/1796-67-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/1796-68-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/1796-69-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/1796-70-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/1796-71-0x0000000075C41000-0x0000000075C43000-memory.dmpFilesize
8KB
-
memory/1796-72-0x0000000002E10000-0x0000000003E10000-memory.dmpFilesize
16.0MB