General

  • Target

    e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2

  • Size

    5.9MB

  • Sample

    220502-wv4khsfbhr

  • MD5

    390631e07e9b222c486f6c09fb4d007e

  • SHA1

    bd4ce4a8eeef7effad15dcdf704e9ad8f8a4de1f

  • SHA256

    e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2

  • SHA512

    bfb68feca7437efd05b3d1d6f7549573e63ac2e99d854186b90aaafec6ae070e56e06533cb7a708279bb0b3883c341ae7a9fa52a12198831836ff30826ea8cde

Malware Config

Targets

    • Target

      e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2

    • Size

      5.9MB

    • MD5

      390631e07e9b222c486f6c09fb4d007e

    • SHA1

      bd4ce4a8eeef7effad15dcdf704e9ad8f8a4de1f

    • SHA256

      e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2

    • SHA512

      bfb68feca7437efd05b3d1d6f7549573e63ac2e99d854186b90aaafec6ae070e56e06533cb7a708279bb0b3883c341ae7a9fa52a12198831836ff30826ea8cde

    • Modifies WinLogon for persistence

    • RevcodeRat, WebMonitorRat

      WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

    • WebMonitor Payload

    • suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

      suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks