webmonitor | 18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52

Analysis

max time kernel
132s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
15-04-2022 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe
Size

1.1MB
MD5

46251cfdab21778b84b03cf7ce34f48c
SHA1

a30a503554703f2f9d4839636433f69ae0cd0ceb
SHA256

18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52
SHA512

34b413075368fa09b2b6c7cbd76f7cae2f734f1cf0f47f839b2eed1747ee99d054a57753ebf13202f762ab735961b6011b5b400bafce2cf4913873b23f49bb5f

Score

10^/10

webmonitor backdoor infostealer rat

Malware Config

Extracted

Family

webmonitor

niiarmah.wm01.to:443

Attributes

config_key
4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O
private_key
yvkn5wM8E
url_path
/recv5.php

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 4 IoCs

resource	yara_rule
behavioral2/memory/3596-133-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral2/memory/3596-136-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral2/memory/3596-137-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral2/memory/3596-138-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor

Executes dropped EXE 1 IoCs

pid	Process
3596	svhost.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	svhost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4092 set thread context of 3596	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4012	timeout.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\FolderN\Security.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe
4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe
4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe
Token: SeShutdownPrivilege	3596	svhost.exe
Token: SeCreatePagefilePrivilege	3596	svhost.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3596	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	87
PID 4092 wrote to memory of 3596	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	87
PID 4092 wrote to memory of 3596	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	87
PID 4092 wrote to memory of 3596	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	87
PID 4092 wrote to memory of 3596	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	87
PID 4092 wrote to memory of 3596	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	87
PID 4092 wrote to memory of 3596	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	87
PID 4092 wrote to memory of 3596	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	87
PID 4092 wrote to memory of 3596	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	87
PID 4092 wrote to memory of 2056	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	88
PID 4092 wrote to memory of 2056	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	88
PID 4092 wrote to memory of 2056	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	88
PID 4092 wrote to memory of 2300	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	90
PID 4092 wrote to memory of 2300	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	90
PID 4092 wrote to memory of 2300	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	90
PID 2300 wrote to memory of 2760	2300	cmd.exe	92
PID 2300 wrote to memory of 2760	2300	cmd.exe	92
PID 2300 wrote to memory of 2760	2300	cmd.exe	92
PID 4092 wrote to memory of 936	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	93
PID 4092 wrote to memory of 936	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	93
PID 4092 wrote to memory of 936	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	93
PID 4092 wrote to memory of 3648	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	95
PID 4092 wrote to memory of 3648	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	95
PID 4092 wrote to memory of 3648	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	95
PID 4092 wrote to memory of 3120	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	97
PID 4092 wrote to memory of 3120	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	97
PID 4092 wrote to memory of 3120	4092	18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe	97
PID 3120 wrote to memory of 4012	3120	cmd.exe	99
PID 3120 wrote to memory of 4012	3120	cmd.exe	99
PID 3120 wrote to memory of 4012	3120	cmd.exe	99
PID 3596 wrote to memory of 3428	3596	svhost.exe	100
PID 3596 wrote to memory of 3428	3596	svhost.exe	100
PID 3596 wrote to memory of 3428	3596	svhost.exe	100

C:\Users\Admin\AppData\Local\Temp\18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe
"C:\Users\Admin\AppData\Local\Temp\18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ehAogNZTRGcpoLOu.bat" "
    3⤵
    PID:3428
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52.exe" "%appdata%\FolderN\Security.exe" /Y
  2⤵
  PID:2056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%appdata%\FolderN\Security.exe.lnk" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderN\Security.exe.lnk" /f
    3⤵
    PID:2760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\FolderN\Security.exe:Zone.Identifier
  2⤵
  - NTFS ADS
  PID:936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ren "%appdata%\FolderN\Security.exe.jpg" Security.exe
  2⤵
  PID:3648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\FolderN\Security.exe.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1140
    3⤵
    - Delays execution with timeout.exe
    PID:4012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ehAogNZTRGcpoLOu.bat

Filesize
204B

MD5
ce54bce40a77e64da5e338f7cb6b8813

SHA1
e28d3d7dd266e09401787191a132fbbbb5d4603b

SHA256
e761b801d8750415e729699ec34a3ebb193f35d73e5ddbe463a4d87461b7d01d

SHA512
acef6b4d5922381c83f31494f1802b14aa128bea4af4aa5bd2d4fec21bf8ab98bc9825ea4d33920865734bc9e241c93f3c36721205a11bb9e01b7fa989ed925e

Download Submit
C:\Users\Admin\AppData\Local\Temp\svhost.exe

Filesize
2.5MB

MD5
0a7608db01cae07792cea95e792aa866

SHA1
71dff876e4d5edb6cea78fee7aa15845d4950e24

SHA256
c16336ab32195b08c1678220fbe0256fee865f623e2b32fcfa4d9825fd68977e

SHA512
990a6fa1b8adb6727b1dcd8931ad84fdcb556533b78f896a71eae2a7e3ae3222e4b8efaa4b629ced2841211750e0d8a75ddd546a983c2e586918dd8ba4e0dc42

Download Submit
C:\Users\Admin\AppData\Local\Temp\svhost.exe

Filesize
2.5MB

MD5
0a7608db01cae07792cea95e792aa866

SHA1
71dff876e4d5edb6cea78fee7aa15845d4950e24

SHA256
c16336ab32195b08c1678220fbe0256fee865f623e2b32fcfa4d9825fd68977e

SHA512
990a6fa1b8adb6727b1dcd8931ad84fdcb556533b78f896a71eae2a7e3ae3222e4b8efaa4b629ced2841211750e0d8a75ddd546a983c2e586918dd8ba4e0dc42

Download Submit
C:\Users\Admin\AppData\Roaming\FolderN\Security.exe

Filesize
1.1MB

MD5
46251cfdab21778b84b03cf7ce34f48c

SHA1
a30a503554703f2f9d4839636433f69ae0cd0ceb

SHA256
18ee3ef64924f4dd006ac40ef62aba58ffa82c49b705209bda9d378c183a6c52

SHA512
34b413075368fa09b2b6c7cbd76f7cae2f734f1cf0f47f839b2eed1747ee99d054a57753ebf13202f762ab735961b6011b5b400bafce2cf4913873b23f49bb5f

Download Submit
C:\Users\Admin\AppData\Roaming\FolderN\Security.exe.bat

Filesize
206B

MD5
a3690ef376097df8129f156e5d2fecbc

SHA1
b8b00356978f0d75ccbfba0833444d577623c96d

SHA256
a071146f80adadcf680d776f45042f10e3698f3ef223c9fce6196d2cc0cdaa85

SHA512
256b20ebe2d6fa4cce2eaf2b861329b91b2f8b69c2c383fb7f7b9d106568b82e2dd44cd8d04bc52a6a5c863e4e92976dbacb74d009d86302695d214c8fcda5a1

Download Submit
memory/3596-138-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3596-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3596-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3596-133-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4092-130-0x0000000000C70000-0x0000000000D8A000-memory.dmp

Filesize
1.1MB

Download
memory/4092-131-0x00000000056C0000-0x000000000575C000-memory.dmp

Filesize
624KB

Download