Analysis
-
max time kernel
134s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 22:21
Static task
static1
Behavioral task
behavioral1
Sample
3a161baa6ade1fd9b3430a4a828956473e7c91f6d9e05a448452136d99095aac.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3a161baa6ade1fd9b3430a4a828956473e7c91f6d9e05a448452136d99095aac.exe
Resource
win10v2004-20220414-en
General
-
Target
3a161baa6ade1fd9b3430a4a828956473e7c91f6d9e05a448452136d99095aac.exe
-
Size
694KB
-
MD5
df280dda64ba0e93d9e80779eb9b2491
-
SHA1
30cb99df159bb60b3a9356b0f626deb0c95d56e1
-
SHA256
3a161baa6ade1fd9b3430a4a828956473e7c91f6d9e05a448452136d99095aac
-
SHA512
c48c57d07025b2342dedc715d35b3b7e3ccf4e3f3abafc81469c0c217c0f7df1b1d3a940ab8a98a1152b6edd2dcd4ae94f83d118467d92a69d26e66cf6e063fa
Malware Config
Extracted
webmonitor
vit0x.wm01.to:443
-
config_key
sfh0MavnyDfXzTlYYGRziPhnyIYnjr6k
-
private_key
pjaH84P73
-
url_path
/recv5.php
Signatures
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3168-135-0x0000000000400000-0x00000000004F6000-memory.dmp family_webmonitor behavioral2/memory/3168-136-0x0000000000400000-0x00000000004F6000-memory.dmp family_webmonitor -
Processes:
resource yara_rule behavioral2/memory/3168-132-0x0000000000400000-0x00000000004F6000-memory.dmp upx behavioral2/memory/3168-133-0x0000000000400000-0x00000000004F6000-memory.dmp upx behavioral2/memory/3168-134-0x0000000000400000-0x00000000004F6000-memory.dmp upx behavioral2/memory/3168-135-0x0000000000400000-0x00000000004F6000-memory.dmp upx behavioral2/memory/3168-136-0x0000000000400000-0x00000000004F6000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3a161baa6ade1fd9b3430a4a828956473e7c91f6d9e05a448452136d99095aac.exedescription pid process target process PID 3396 set thread context of 3168 3396 3a161baa6ade1fd9b3430a4a828956473e7c91f6d9e05a448452136d99095aac.exe RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeShutdownPrivilege 3168 RegSvcs.exe Token: SeCreatePagefilePrivilege 3168 RegSvcs.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
3a161baa6ade1fd9b3430a4a828956473e7c91f6d9e05a448452136d99095aac.exeRegSvcs.exedescription pid process target process PID 3396 wrote to memory of 3168 3396 3a161baa6ade1fd9b3430a4a828956473e7c91f6d9e05a448452136d99095aac.exe RegSvcs.exe PID 3396 wrote to memory of 3168 3396 3a161baa6ade1fd9b3430a4a828956473e7c91f6d9e05a448452136d99095aac.exe RegSvcs.exe PID 3396 wrote to memory of 3168 3396 3a161baa6ade1fd9b3430a4a828956473e7c91f6d9e05a448452136d99095aac.exe RegSvcs.exe PID 3396 wrote to memory of 3168 3396 3a161baa6ade1fd9b3430a4a828956473e7c91f6d9e05a448452136d99095aac.exe RegSvcs.exe PID 3396 wrote to memory of 3168 3396 3a161baa6ade1fd9b3430a4a828956473e7c91f6d9e05a448452136d99095aac.exe RegSvcs.exe PID 3396 wrote to memory of 3168 3396 3a161baa6ade1fd9b3430a4a828956473e7c91f6d9e05a448452136d99095aac.exe RegSvcs.exe PID 3396 wrote to memory of 3168 3396 3a161baa6ade1fd9b3430a4a828956473e7c91f6d9e05a448452136d99095aac.exe RegSvcs.exe PID 3168 wrote to memory of 4436 3168 RegSvcs.exe cmd.exe PID 3168 wrote to memory of 4436 3168 RegSvcs.exe cmd.exe PID 3168 wrote to memory of 4436 3168 RegSvcs.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a161baa6ade1fd9b3430a4a828956473e7c91f6d9e05a448452136d99095aac.exe"C:\Users\Admin\AppData\Local\Temp\3a161baa6ade1fd9b3430a4a828956473e7c91f6d9e05a448452136d99095aac.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CGV0OSBzxtSz8Rcr.bat" "3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\CGV0OSBzxtSz8Rcr.batFilesize
204B
MD5538331f2b0faad64ac26cd005c6a90ad
SHA1740e571f4657f74df3b19bf6c851b9c72256c1b0
SHA25625e4ac2811cdb09b93d48f2e250355b7830b1146f4983e36a32e60a023e1782e
SHA51218688bae0b1838493f4644c44248b4500ceea8f2d054cb2e679e82a9170b40332823890e1cccf0d0e989db341fbe0f66807b21f004261fbb141b271b744dbf0a
-
memory/3168-131-0x0000000000000000-mapping.dmp
-
memory/3168-132-0x0000000000400000-0x00000000004F6000-memory.dmpFilesize
984KB
-
memory/3168-133-0x0000000000400000-0x00000000004F6000-memory.dmpFilesize
984KB
-
memory/3168-134-0x0000000000400000-0x00000000004F6000-memory.dmpFilesize
984KB
-
memory/3168-135-0x0000000000400000-0x00000000004F6000-memory.dmpFilesize
984KB
-
memory/3168-136-0x0000000000400000-0x00000000004F6000-memory.dmpFilesize
984KB
-
memory/3396-130-0x00000000747F0000-0x0000000074DA1000-memory.dmpFilesize
5.7MB
-
memory/4436-137-0x0000000000000000-mapping.dmp