Analysis

  • max time kernel
    151s
  • max time network
    175s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    04-06-2022 15:39

General

  • Target

    0f6c9c6fbd87f9ee7bb66f6d9302f0334c3b16a2a4c2482d3db0ff117fcb1e06.exe

  • Size

    586KB

  • MD5

    b26c6f36a8711168dc8d2882a6cab0c2

  • SHA1

    e133a7dad21664672df96f0e6c956effe2ac7350

  • SHA256

    0f6c9c6fbd87f9ee7bb66f6d9302f0334c3b16a2a4c2482d3db0ff117fcb1e06

  • SHA512

    f865d9cd05796cd4dfb69e1a9748b14c9d3ca49d29f5dee1bc8df367dc9f141ac1208a13a986f18963df2b70ff56aa76e7f2b0c7d9e2199ee472e24a24934910

Malware Config

Extracted

Family

webmonitor

C2

holmes101.wm01.to:443

Attributes
  • config_key

    XKulJBlUogMPPhL5GnUay2DqaaoA6mr7

  • private_key

    rwh8ivgQh

  • url_path

    /recv4.php

Signatures

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

  • WebMonitor Payload 3 IoCs
  • suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

    suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

  • Executes dropped EXE 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 1 IoCs
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f6c9c6fbd87f9ee7bb66f6d9302f0334c3b16a2a4c2482d3db0ff117fcb1e06.exe
    "C:\Users\Admin\AppData\Local\Temp\0f6c9c6fbd87f9ee7bb66f6d9302f0334c3b16a2a4c2482d3db0ff117fcb1e06.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:916
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\0f6c9c6fbd87f9ee7bb66f6d9302f0334c3b16a2a4c2482d3db0ff117fcb1e06.exe" "C:\Users\Admin\AppData\Local\litegen.exe"
      2⤵
        PID:2012
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\litegen.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1032
        • C:\Users\Admin\AppData\Local\litegen.exe
          "C:\Users\Admin\AppData\Local\litegen.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:268
          • C:\Users\Admin\AppData\Local\litegen.exe
            "C:\Users\Admin\AppData\Local\litegen.exe"
            4⤵
            • Executes dropped EXE
            PID:1612

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\litegen.exe

      Filesize

      586KB

      MD5

      b26c6f36a8711168dc8d2882a6cab0c2

      SHA1

      e133a7dad21664672df96f0e6c956effe2ac7350

      SHA256

      0f6c9c6fbd87f9ee7bb66f6d9302f0334c3b16a2a4c2482d3db0ff117fcb1e06

      SHA512

      f865d9cd05796cd4dfb69e1a9748b14c9d3ca49d29f5dee1bc8df367dc9f141ac1208a13a986f18963df2b70ff56aa76e7f2b0c7d9e2199ee472e24a24934910

    • C:\Users\Admin\AppData\Local\litegen.exe

      Filesize

      586KB

      MD5

      b26c6f36a8711168dc8d2882a6cab0c2

      SHA1

      e133a7dad21664672df96f0e6c956effe2ac7350

      SHA256

      0f6c9c6fbd87f9ee7bb66f6d9302f0334c3b16a2a4c2482d3db0ff117fcb1e06

      SHA512

      f865d9cd05796cd4dfb69e1a9748b14c9d3ca49d29f5dee1bc8df367dc9f141ac1208a13a986f18963df2b70ff56aa76e7f2b0c7d9e2199ee472e24a24934910

    • C:\Users\Admin\AppData\Local\litegen.exe

      Filesize

      586KB

      MD5

      b26c6f36a8711168dc8d2882a6cab0c2

      SHA1

      e133a7dad21664672df96f0e6c956effe2ac7350

      SHA256

      0f6c9c6fbd87f9ee7bb66f6d9302f0334c3b16a2a4c2482d3db0ff117fcb1e06

      SHA512

      f865d9cd05796cd4dfb69e1a9748b14c9d3ca49d29f5dee1bc8df367dc9f141ac1208a13a986f18963df2b70ff56aa76e7f2b0c7d9e2199ee472e24a24934910

    • \Users\Admin\AppData\Local\litegen.exe

      Filesize

      586KB

      MD5

      b26c6f36a8711168dc8d2882a6cab0c2

      SHA1

      e133a7dad21664672df96f0e6c956effe2ac7350

      SHA256

      0f6c9c6fbd87f9ee7bb66f6d9302f0334c3b16a2a4c2482d3db0ff117fcb1e06

      SHA512

      f865d9cd05796cd4dfb69e1a9748b14c9d3ca49d29f5dee1bc8df367dc9f141ac1208a13a986f18963df2b70ff56aa76e7f2b0c7d9e2199ee472e24a24934910

    • memory/268-76-0x0000000072010000-0x0000000072A20000-memory.dmp

      Filesize

      10.1MB

    • memory/268-101-0x0000000074160000-0x0000000074331000-memory.dmp

      Filesize

      1.8MB

    • memory/268-79-0x0000000070330000-0x0000000070B10000-memory.dmp

      Filesize

      7.9MB

    • memory/268-98-0x0000000074160000-0x0000000074331000-memory.dmp

      Filesize

      1.8MB

    • memory/268-95-0x0000000070330000-0x0000000070B10000-memory.dmp

      Filesize

      7.9MB

    • memory/268-94-0x00000000712F0000-0x000000007200D000-memory.dmp

      Filesize

      13.1MB

    • memory/268-93-0x0000000074660000-0x00000000747F4000-memory.dmp

      Filesize

      1.6MB

    • memory/268-92-0x0000000072A20000-0x0000000073DAF000-memory.dmp

      Filesize

      19.6MB

    • memory/268-83-0x0000000000440000-0x000000000044A000-memory.dmp

      Filesize

      40KB

    • memory/268-78-0x00000000712F0000-0x000000007200D000-memory.dmp

      Filesize

      13.1MB

    • memory/268-70-0x00000000008E0000-0x0000000000978000-memory.dmp

      Filesize

      608KB

    • memory/268-80-0x0000000072A20000-0x0000000073DAF000-memory.dmp

      Filesize

      19.6MB

    • memory/268-82-0x0000000074660000-0x00000000747F4000-memory.dmp

      Filesize

      1.6MB

    • memory/268-81-0x0000000072010000-0x0000000072A20000-memory.dmp

      Filesize

      10.1MB

    • memory/268-77-0x0000000074660000-0x00000000747F4000-memory.dmp

      Filesize

      1.6MB

    • memory/268-75-0x0000000072A20000-0x0000000073DAF000-memory.dmp

      Filesize

      19.6MB

    • memory/916-61-0x0000000072A20000-0x0000000073DAF000-memory.dmp

      Filesize

      19.6MB

    • memory/916-71-0x0000000072A20000-0x0000000073DAF000-memory.dmp

      Filesize

      19.6MB

    • memory/916-73-0x0000000074660000-0x00000000747F4000-memory.dmp

      Filesize

      1.6MB

    • memory/916-57-0x0000000072010000-0x0000000072A20000-memory.dmp

      Filesize

      10.1MB

    • memory/916-59-0x00000000712F0000-0x000000007200D000-memory.dmp

      Filesize

      13.1MB

    • memory/916-56-0x0000000072A20000-0x0000000073DAF000-memory.dmp

      Filesize

      19.6MB

    • memory/916-72-0x0000000072010000-0x0000000072A20000-memory.dmp

      Filesize

      10.1MB

    • memory/916-55-0x00000000005E0000-0x00000000005FE000-memory.dmp

      Filesize

      120KB

    • memory/916-58-0x0000000074660000-0x00000000747F4000-memory.dmp

      Filesize

      1.6MB

    • memory/916-60-0x0000000070B10000-0x00000000712F0000-memory.dmp

      Filesize

      7.9MB

    • memory/916-62-0x0000000072010000-0x0000000072A20000-memory.dmp

      Filesize

      10.1MB

    • memory/916-63-0x0000000074660000-0x00000000747F4000-memory.dmp

      Filesize

      1.6MB

    • memory/916-54-0x00000000002F0000-0x0000000000388000-memory.dmp

      Filesize

      608KB

    • memory/916-74-0x00000000712F0000-0x000000007200D000-memory.dmp

      Filesize

      13.1MB

    • memory/1612-91-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/1612-88-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/1612-96-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

      Filesize

      8KB

    • memory/1612-87-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/1612-85-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/1612-97-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/1612-99-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/1612-100-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/1612-84-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/1612-102-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB