webmonitor | 17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80

General

Target

17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe
Size

840KB
MD5

8a2123d4809ffdc677df37b88d58769c
SHA1

4138f2da78ccf7ed3a07d455fddb367f59568d04
SHA256

17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80
SHA512

632870596e6f41adefce8a6589ee75b9df1ab483e619d2a2e555f6878a48007c5a38267c576ef3b056559d5348994427e46690034a59388aeee910f4fa93f671

Score

10^/10

webmonitor backdoor infostealer rat upx

Malware Config

Extracted

Family

webmonitor

C2

mafianclub.wm01.to:443

Attributes

config_key
msK8483mYp1k2OzxD1I3yoSUcNW7v1k5
private_key
WB8PgMeHa
url_path
/recv5.php

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3712-139-0x0000000000400000-0x00000000004F6000-memory.dmp	family_webmonitor
behavioral2/memory/3712-140-0x0000000000400000-0x00000000004F6000-memory.dmp	family_webmonitor
behavioral2/memory/3712-141-0x0000000000400000-0x00000000004F6000-memory.dmp	family_webmonitor
behavioral2/memory/3712-143-0x0000000000400000-0x00000000004F6000-memory.dmp	family_webmonitor

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3712-136-0x0000000000400000-0x00000000004F6000-memory.dmp	upx
behavioral2/memory/3712-137-0x0000000000400000-0x00000000004F6000-memory.dmp	upx
behavioral2/memory/3712-138-0x0000000000400000-0x00000000004F6000-memory.dmp	upx
behavioral2/memory/3712-139-0x0000000000400000-0x00000000004F6000-memory.dmp	upx
behavioral2/memory/3712-140-0x0000000000400000-0x00000000004F6000-memory.dmp	upx
behavioral2/memory/3712-141-0x0000000000400000-0x00000000004F6000-memory.dmp	upx
behavioral2/memory/3712-143-0x0000000000400000-0x00000000004F6000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

RegAsm.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation RegAsm.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe

description	pid	process	target process
PID 1996 set thread context of 3712	1996	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe

pid	process
1996	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe
1996	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe
1996	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1996	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe
Token: SeShutdownPrivilege	3712	RegAsm.exe
Token: SeCreatePagefilePrivilege	3712	RegAsm.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exeRegAsm.exe

description	pid	process	target process
PID 1996 wrote to memory of 3712	1996	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe	RegAsm.exe
PID 1996 wrote to memory of 3712	1996	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe	RegAsm.exe
PID 1996 wrote to memory of 3712	1996	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe	RegAsm.exe
PID 1996 wrote to memory of 3712	1996	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe	RegAsm.exe
PID 1996 wrote to memory of 3712	1996	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe	RegAsm.exe
PID 1996 wrote to memory of 3712	1996	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe	RegAsm.exe
PID 1996 wrote to memory of 3712	1996	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe	RegAsm.exe
PID 1996 wrote to memory of 3712	1996	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe	RegAsm.exe
PID 3712 wrote to memory of 4868	3712	RegAsm.exe	cmd.exe
PID 3712 wrote to memory of 4868	3712	RegAsm.exe	cmd.exe
PID 3712 wrote to memory of 4868	3712	RegAsm.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe
"C:\Users\Admin\AppData\Local\Temp\17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\agdDo5DUyQcJWN5P.bat" "
    3⤵
    PID:4868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\agdDo5DUyQcJWN5P.bat

Filesize
204B

MD5
8fb8e22c573b41a296ac5346cf74d368

SHA1
f853ba007403cec8c3a28c9d5062abf7a4896a9e

SHA256
1b28773c2d377a451e5de353dd24faa9e0a6b67765834d482edd3ece4bdeafce

SHA512
f819b075737ab14d85d1772a3f889e2809e50a598d2cae851b2b22e702b9c7594cdf7eec1b4683fe1733d2ee504ae0398beceacf14ddf71ee3fa6728d994dd84

Download Submit
memory/1996-130-0x00000000009B0000-0x0000000000A88000-memory.dmp

Filesize
864KB

Download
memory/1996-131-0x00000000054C0000-0x0000000005552000-memory.dmp

Filesize
584KB

Download
memory/1996-132-0x0000000005B10000-0x00000000060B4000-memory.dmp

Filesize
5.6MB

Download
memory/1996-133-0x00000000055B0000-0x00000000055F4000-memory.dmp

Filesize
272KB

Download
memory/1996-134-0x00000000061A0000-0x0000000006206000-memory.dmp

Filesize
408KB

Download
memory/3712-136-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/3712-137-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/3712-138-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/3712-139-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/3712-140-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/3712-141-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/3712-143-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/3712-135-0x0000000000000000-mapping.dmp

Download
memory/4868-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads