Analysis
-
max time kernel
182s -
max time network
198s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
16-05-2022 12:52
Static task
static1
Behavioral task
behavioral1
Sample
48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe
Resource
win10v2004-20220414-en
General
-
Target
48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe
-
Size
17.2MB
-
MD5
ee9a4ee14382824e759636426db0aa6f
-
SHA1
5ff8faa6df6c1ef352d4938be39a97092dd1c7c7
-
SHA256
48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876
-
SHA512
4c7a3f81eb713b68c5cf8376ec5f55428294732f2c97bf5cd8bea876d569d2bf1e2d3a9c09e64b51411deaf37f1670d02a1cf192e7427f9cef3135f4a09b6656
Malware Config
Extracted
webmonitor
worldbala.wm01.to:443
-
config_key
1vt5MKV6CcJnGWsNVlYXmKcidNN2mBKt
-
private_key
NcwyDvFB8
-
url_path
/recv4.php
Signatures
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4976-147-0x0000000000400000-0x00000000004BE000-memory.dmp family_webmonitor behavioral2/memory/4976-148-0x0000000000400000-0x00000000004BE000-memory.dmp family_webmonitor behavioral2/memory/4976-149-0x0000000000400000-0x00000000004BE000-memory.dmp family_webmonitor behavioral2/memory/4976-150-0x0000000000400000-0x00000000004BE000-memory.dmp family_webmonitor -
Executes dropped EXE 1 IoCs
Processes:
GfnWebBrowser.exepid process 2344 GfnWebBrowser.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exeGfnWebBrowser.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation GfnWebBrowser.exe -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 185.243.215.214 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
GfnWebBrowser.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GfnWebBrowser = "C:\\Users\\Admin\\AppData\\Roaming\\GfnWebBrowser.exe -boot" GfnWebBrowser.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
GfnWebBrowser.exedescription pid process target process PID 2344 set thread context of 4976 2344 GfnWebBrowser.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 5 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\GfnWebBrowser.exe\:Zone.Identifier:$DATA cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\GfnWebBrowser.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\GfnWebBrowser.exe:Zone.Identifier cmd.exe File created C:\Users\Admin\AppData\Local\Temp\48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe:Zone.Identifier cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exeGfnWebBrowser.exedescription pid process Token: SeDebugPrivilege 400 48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe Token: SeDebugPrivilege 2344 GfnWebBrowser.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.execmd.exeGfnWebBrowser.exedescription pid process target process PID 400 wrote to memory of 1324 400 48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe cmd.exe PID 400 wrote to memory of 1324 400 48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe cmd.exe PID 400 wrote to memory of 1324 400 48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe cmd.exe PID 400 wrote to memory of 3668 400 48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe cmd.exe PID 400 wrote to memory of 3668 400 48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe cmd.exe PID 400 wrote to memory of 3668 400 48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe cmd.exe PID 400 wrote to memory of 944 400 48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe cmd.exe PID 400 wrote to memory of 944 400 48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe cmd.exe PID 400 wrote to memory of 944 400 48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe cmd.exe PID 400 wrote to memory of 3672 400 48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe cmd.exe PID 400 wrote to memory of 3672 400 48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe cmd.exe PID 400 wrote to memory of 3672 400 48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe cmd.exe PID 3672 wrote to memory of 2344 3672 cmd.exe GfnWebBrowser.exe PID 3672 wrote to memory of 2344 3672 cmd.exe GfnWebBrowser.exe PID 3672 wrote to memory of 2344 3672 cmd.exe GfnWebBrowser.exe PID 2344 wrote to memory of 3420 2344 GfnWebBrowser.exe cmd.exe PID 2344 wrote to memory of 3420 2344 GfnWebBrowser.exe cmd.exe PID 2344 wrote to memory of 3420 2344 GfnWebBrowser.exe cmd.exe PID 2344 wrote to memory of 4664 2344 GfnWebBrowser.exe cmd.exe PID 2344 wrote to memory of 4664 2344 GfnWebBrowser.exe cmd.exe PID 2344 wrote to memory of 4664 2344 GfnWebBrowser.exe cmd.exe PID 2344 wrote to memory of 4976 2344 GfnWebBrowser.exe AppLaunch.exe PID 2344 wrote to memory of 4976 2344 GfnWebBrowser.exe AppLaunch.exe PID 2344 wrote to memory of 4976 2344 GfnWebBrowser.exe AppLaunch.exe PID 2344 wrote to memory of 4976 2344 GfnWebBrowser.exe AppLaunch.exe PID 2344 wrote to memory of 4976 2344 GfnWebBrowser.exe AppLaunch.exe PID 2344 wrote to memory of 4976 2344 GfnWebBrowser.exe AppLaunch.exe PID 2344 wrote to memory of 4976 2344 GfnWebBrowser.exe AppLaunch.exe PID 2344 wrote to memory of 4976 2344 GfnWebBrowser.exe AppLaunch.exe PID 2344 wrote to memory of 4976 2344 GfnWebBrowser.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe"C:\Users\Admin\AppData\Local\Temp\48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876.exe" "C:\Users\Admin\AppData\Roaming\GfnWebBrowser.exe"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\GfnWebBrowser.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\GfnWebBrowser.exe"C:\Users\Admin\AppData\Roaming\GfnWebBrowser.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\GfnWebBrowser.exe:Zone.Identifier"4⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\GfnWebBrowser.exe:Zone.Identifier"4⤵
- NTFS ADS
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\GfnWebBrowser.exeFilesize
17.2MB
MD5ee9a4ee14382824e759636426db0aa6f
SHA15ff8faa6df6c1ef352d4938be39a97092dd1c7c7
SHA25648d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876
SHA5124c7a3f81eb713b68c5cf8376ec5f55428294732f2c97bf5cd8bea876d569d2bf1e2d3a9c09e64b51411deaf37f1670d02a1cf192e7427f9cef3135f4a09b6656
-
C:\Users\Admin\AppData\Roaming\GfnWebBrowser.exeFilesize
17.2MB
MD5ee9a4ee14382824e759636426db0aa6f
SHA15ff8faa6df6c1ef352d4938be39a97092dd1c7c7
SHA25648d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876
SHA5124c7a3f81eb713b68c5cf8376ec5f55428294732f2c97bf5cd8bea876d569d2bf1e2d3a9c09e64b51411deaf37f1670d02a1cf192e7427f9cef3135f4a09b6656
-
memory/400-130-0x0000000000D30000-0x0000000001DD2000-memory.dmpFilesize
16.6MB
-
memory/400-132-0x0000000007120000-0x0000000007186000-memory.dmpFilesize
408KB
-
memory/400-133-0x0000000007360000-0x0000000007522000-memory.dmpFilesize
1.8MB
-
memory/400-134-0x0000000006670000-0x0000000006692000-memory.dmpFilesize
136KB
-
memory/400-135-0x0000000007AE0000-0x0000000008084000-memory.dmpFilesize
5.6MB
-
memory/400-137-0x0000000007270000-0x0000000007302000-memory.dmpFilesize
584KB
-
memory/944-138-0x0000000000000000-mapping.dmp
-
memory/1324-131-0x0000000000000000-mapping.dmp
-
memory/2344-140-0x0000000000000000-mapping.dmp
-
memory/2344-145-0x0000000002250000-0x00000000022EC000-memory.dmpFilesize
624KB
-
memory/3420-143-0x0000000000000000-mapping.dmp
-
memory/3668-136-0x0000000000000000-mapping.dmp
-
memory/3672-139-0x0000000000000000-mapping.dmp
-
memory/4664-144-0x0000000000000000-mapping.dmp
-
memory/4976-146-0x0000000000000000-mapping.dmp
-
memory/4976-147-0x0000000000400000-0x00000000004BE000-memory.dmpFilesize
760KB
-
memory/4976-148-0x0000000000400000-0x00000000004BE000-memory.dmpFilesize
760KB
-
memory/4976-149-0x0000000000400000-0x00000000004BE000-memory.dmpFilesize
760KB
-
memory/4976-150-0x0000000000400000-0x00000000004BE000-memory.dmpFilesize
760KB