Analysis
-
max time kernel
153s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
02-05-2022 17:55
Static task
static1
Behavioral task
behavioral1
Sample
a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exe
Resource
win10v2004-20220414-en
General
-
Target
a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exe
-
Size
2.9MB
-
MD5
87a119cb90e4c20d11fe569b9e26f0b6
-
SHA1
bf548af2eaf6272b3e7810b36595451542e5b4ba
-
SHA256
a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118
-
SHA512
c4ae15f80ee122c35694259e48155a69b5bdf4a7d1b4cf753cdb40dc6efd3833eb4b54afb087060ba51ec6c6f54c0d897df68fa5b26b1d4406ea6c568f6b213f
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
regasm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\dd3gmioMwPer0i8R\\v86SiBEhD6Az.exe\",explorer.exe" regasm.exe -
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3316-192-0x0000000000400000-0x00000000005F7000-memory.dmp family_webmonitor behavioral2/memory/3316-193-0x0000000000400000-0x00000000005F7000-memory.dmp family_webmonitor -
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
-
Executes dropped EXE 1 IoCs
Processes:
Setup.exepid process 3384 Setup.exe -
Processes:
resource yara_rule behavioral2/memory/3316-189-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral2/memory/3316-190-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral2/memory/3316-191-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral2/memory/3316-192-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral2/memory/3316-193-0x0000000000400000-0x00000000005F7000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exe -
Loads dropped DLL 1 IoCs
Processes:
Setup.exepid process 3384 Setup.exe -
Unexpected DNS network traffic destination 15 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 114.114.114.114 Destination IP 1.2.4.8 Destination IP 185.243.215.214 Destination IP 114.114.114.114 Destination IP 185.243.215.214 Destination IP 1.2.4.8 Destination IP 1.2.4.8 Destination IP 185.243.215.214 Destination IP 185.243.215.214 Destination IP 114.114.114.114 Destination IP 1.2.4.8 Destination IP 185.243.215.214 Destination IP 185.243.215.214 Destination IP 114.114.114.114 Destination IP 185.243.215.214 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exeregasm.exedescription pid process target process PID 408 set thread context of 1628 408 a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exe regasm.exe PID 1628 set thread context of 3316 1628 regasm.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 43 IoCs
Processes:
Setup.exeregasm.exepid process 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 3384 Setup.exe 1628 regasm.exe 1628 regasm.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exepid process 408 a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
Setup.exeregasm.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 3384 Setup.exe Token: SeDebugPrivilege 1628 regasm.exe Token: SeDebugPrivilege 3316 AppLaunch.exe Token: SeShutdownPrivilege 3316 AppLaunch.exe Token: SeCreatePagefilePrivilege 3316 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exeSetup.exepid process 408 a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exe 3384 Setup.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exeregasm.exedescription pid process target process PID 408 wrote to memory of 3384 408 a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exe Setup.exe PID 408 wrote to memory of 3384 408 a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exe Setup.exe PID 408 wrote to memory of 3384 408 a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exe Setup.exe PID 408 wrote to memory of 1628 408 a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exe regasm.exe PID 408 wrote to memory of 1628 408 a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exe regasm.exe PID 408 wrote to memory of 1628 408 a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exe regasm.exe PID 408 wrote to memory of 1628 408 a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exe regasm.exe PID 1628 wrote to memory of 3316 1628 regasm.exe AppLaunch.exe PID 1628 wrote to memory of 3316 1628 regasm.exe AppLaunch.exe PID 1628 wrote to memory of 3316 1628 regasm.exe AppLaunch.exe PID 1628 wrote to memory of 3316 1628 regasm.exe AppLaunch.exe PID 1628 wrote to memory of 3316 1628 regasm.exe AppLaunch.exe PID 1628 wrote to memory of 3316 1628 regasm.exe AppLaunch.exe PID 1628 wrote to memory of 3316 1628 regasm.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exe"C:\Users\Admin\AppData\Local\Temp\a902b091e859022ae263bab22a5cf75d5b892314c455752a2d9195d326537118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"2⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\SkinSoft\VisualStyler\2.4.59444.6\x86\ssapihook.dllFilesize
57KB
MD59e7f44b8f1512476aa896e977c58830b
SHA1eddd878d9e16502ee1eb7f583dd04e01b458ba42
SHA2568e6195b50bb0d22e4d346263f708f166db726c84884fe78a6bb477caed19e708
SHA512ea52b71dc58e081d0e6c1336e7bf8422d7240c8a502c790075c6ebfe88f8ff70cd2bf43d34b8c604c08d867202359f8bd35c3a0b8d2eefefe826ccd2e5c8c802
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeFilesize
1.5MB
MD5d6972e3b20498bd9f03aa5a4193544a6
SHA13ffd0be5ae8b65470e5bc3c1acb847913539955d
SHA256f3fa89eda7795d606f0e0deeb8d6ee0633def02f2fb6c5a7a177913a844be2ca
SHA512a412b031f4ce0902d3f606a253bfc75f98d69a7e0d74b0e37db2994f91b74e425954b3f34542234fbd6d8f7737a698d879f85c855d4cc0c409e08304d0c42135
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeFilesize
1.5MB
MD5d6972e3b20498bd9f03aa5a4193544a6
SHA13ffd0be5ae8b65470e5bc3c1acb847913539955d
SHA256f3fa89eda7795d606f0e0deeb8d6ee0633def02f2fb6c5a7a177913a844be2ca
SHA512a412b031f4ce0902d3f606a253bfc75f98d69a7e0d74b0e37db2994f91b74e425954b3f34542234fbd6d8f7737a698d879f85c855d4cc0c409e08304d0c42135
-
memory/408-163-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-135-0x0000000000A0B000-0x0000000000A0F000-memory.dmpFilesize
16KB
-
memory/408-134-0x0000000000A0B000-0x0000000000A0F000-memory.dmpFilesize
16KB
-
memory/408-166-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-164-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-139-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-140-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-141-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-143-0x0000000000A16000-0x0000000000A1B000-memory.dmpFilesize
20KB
-
memory/408-142-0x0000000000A16000-0x0000000000A1B000-memory.dmpFilesize
20KB
-
memory/408-144-0x0000000000A16000-0x0000000000A1B000-memory.dmpFilesize
20KB
-
memory/408-145-0x0000000000A16000-0x0000000000A1B000-memory.dmpFilesize
20KB
-
memory/408-148-0x0000000000A16000-0x0000000000A1B000-memory.dmpFilesize
20KB
-
memory/408-149-0x0000000000A16000-0x0000000000A1B000-memory.dmpFilesize
20KB
-
memory/408-150-0x0000000000A16000-0x0000000000A1B000-memory.dmpFilesize
20KB
-
memory/408-152-0x0000000000A16000-0x0000000000A1B000-memory.dmpFilesize
20KB
-
memory/408-156-0x0000000000A16000-0x0000000000A1B000-memory.dmpFilesize
20KB
-
memory/408-157-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-158-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-159-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-160-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-161-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-162-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-132-0x0000000000A0B000-0x0000000000A0F000-memory.dmpFilesize
16KB
-
memory/408-165-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-138-0x0000000000A0B000-0x0000000000A0F000-memory.dmpFilesize
16KB
-
memory/408-133-0x0000000000A0B000-0x0000000000A0F000-memory.dmpFilesize
16KB
-
memory/408-167-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-168-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-170-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-171-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-169-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-172-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-173-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-174-0x0000000000A25000-0x0000000000A28000-memory.dmpFilesize
12KB
-
memory/408-178-0x0000000000A66000-0x0000000000A68000-memory.dmpFilesize
8KB
-
memory/408-179-0x0000000002740000-0x0000000002748000-memory.dmpFilesize
32KB
-
memory/1628-180-0x0000000000000000-mapping.dmp
-
memory/1628-182-0x0000000000400000-0x00000000004F9000-memory.dmpFilesize
996KB
-
memory/1628-183-0x00000000749A0000-0x0000000074F51000-memory.dmpFilesize
5.7MB
-
memory/3316-190-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/3316-188-0x0000000000000000-mapping.dmp
-
memory/3316-189-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/3316-191-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/3316-192-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/3316-193-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/3316-194-0x0000000002AA0000-0x0000000003AA0000-memory.dmpFilesize
16.0MB
-
memory/3384-181-0x00000000001C0000-0x0000000000350000-memory.dmpFilesize
1.6MB
-
memory/3384-184-0x00000000051B0000-0x0000000005754000-memory.dmpFilesize
5.6MB
-
memory/3384-175-0x0000000000000000-mapping.dmp
-
memory/3384-185-0x0000000004D00000-0x0000000004D92000-memory.dmpFilesize
584KB
-
memory/3384-186-0x0000000004DD0000-0x0000000004DDA000-memory.dmpFilesize
40KB