Overview

overview

10

Static

static

zd4vWiNB908TG99.exe

windows7_x64

10

zd4vWiNB908TG99.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6e66134aa8b2a4317e0e2fff2d8665c2476238c8a37d66359f3e94804f5f86f8

  • Size

    967KB

  • Sample

    220521-anaszaddfp

  • MD5

    b776f299003ca5b86a199c2ef01f39f0

  • SHA1

    8953680419d700de778f1c5905a5f0d7fdbb548d

  • SHA256

    6e66134aa8b2a4317e0e2fff2d8665c2476238c8a37d66359f3e94804f5f86f8

  • SHA512

    63fdbc25da77333e8e70c73fc61d6dd0184f94d424cd0adf37396a643c2b2add297871cd64a22caba4cc011402b3b650069c3c99590a5b44a4f9dc19ca7afb68

Score
10/10
webmonitorbackdoorinfostealerratsuricata

Malware Config

Extracted

Family

webmonitor

C2

niiarmah.wm01.to:443

Attributes
  • config_key

    4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O

  • private_key

    yvkn5wM8E

  • url_path

    /recv5.php

Targets

    • Target

      zd4vWiNB908TG99.exe

    • Size

      1007KB

    • MD5

      f3370ea593b2afe30af97925d3a63295

    • SHA1

      628af1ff11ecd9101e73dc0971d432e1c64e26fe

    • SHA256

      3c8d5a42b3b1e9ec4c489d8ec98ba60d6d107e62b2d1a2cc43570840374ff05f

    • SHA512

      182118828e580fe8e0e1188be751c93fde397af83dbff40f79e439ab3858cd3ce04d81e6c18b9bf264734b92a5bd302746b7a036c6a956ba70020da25532654c

    Score
    10/10
    webmonitorbackdoorinfostealerratsuricata

    • RevcodeRat, WebMonitorRat

      WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

      backdoorratinfostealerwebmonitor

    • WebMonitor Payload

    • suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

      suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

      suricata

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks