webmonitor | 4393b05a23f05af255589f1c32935811d2e6a8f112e54c956b8c52051e0a4669

General

Target

4393b05a23f05af255589f1c32935811d2e6a8f112e54c956b8c52051e0a4669.exe
Size

361KB
MD5

ee6d202c314430288e1babc3c9256f40
SHA1

e1db7db841535428e0bd482b6fcd4e35a5ec7c33
SHA256

4393b05a23f05af255589f1c32935811d2e6a8f112e54c956b8c52051e0a4669
SHA512

ef6ef49b3e5a57a699b2802d2a53ff48db3230e68944bb1b69f8f77180c283055f2efaee59553c7e19371e0bb904084e178f26cea8312ca55e2280057552ecf2

Score

10^/10

webmonitor backdoor infostealer rat upx

Malware Config

Extracted

Family

webmonitor

C2

qqsola.wm01.to:443

Attributes

config_key
jJYLbTB9TsvWtCPWrodDFU1k5EBbvtuI
private_key
neS5F12vo
url_path
/recv5.php

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4296-131-0x0000000000400000-0x00000000004F2000-memory.dmp	family_webmonitor
behavioral2/memory/4296-133-0x0000000000400000-0x00000000004F2000-memory.dmp	family_webmonitor

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4296-131-0x0000000000400000-0x00000000004F2000-memory.dmp	upx
behavioral2/memory/4296-133-0x0000000000400000-0x00000000004F2000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	4393b05a23f05af255589f1c32935811d2e6a8f112e54c956b8c52051e0a4669.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4296	4393b05a23f05af255589f1c32935811d2e6a8f112e54c956b8c52051e0a4669.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4296	4393b05a23f05af255589f1c32935811d2e6a8f112e54c956b8c52051e0a4669.exe
Token: SeCreatePagefilePrivilege	4296	4393b05a23f05af255589f1c32935811d2e6a8f112e54c956b8c52051e0a4669.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 1292	4296	4393b05a23f05af255589f1c32935811d2e6a8f112e54c956b8c52051e0a4669.exe	81
PID 4296 wrote to memory of 1292	4296	4393b05a23f05af255589f1c32935811d2e6a8f112e54c956b8c52051e0a4669.exe	81
PID 4296 wrote to memory of 1292	4296	4393b05a23f05af255589f1c32935811d2e6a8f112e54c956b8c52051e0a4669.exe	81

C:\Users\Admin\AppData\Local\Temp\4393b05a23f05af255589f1c32935811d2e6a8f112e54c956b8c52051e0a4669.exe
"C:\Users\Admin\AppData\Local\Temp\4393b05a23f05af255589f1c32935811d2e6a8f112e54c956b8c52051e0a4669.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\w1pkJHBfcqmmMFI4.bat" "
  2⤵
  PID:1292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\w1pkJHBfcqmmMFI4.bat

Filesize
204B

MD5
b12baf4ed03c744b7d91e9e2b3194922

SHA1
c77dbd4de73fe704a102d7da49b99a240323b670

SHA256
0e18045332373af55eacf3439c489de89164bd3db1b3e788a69dfe6fa46e5198

SHA512
ccc909663f5a4cb9746784a7719f167af077af785e92282f7446b4fc8e2804070e735486a9055cad9bef08aa708189be255d1b8bf130dc89e47c47a49cc38880

Download Submit
memory/4296-131-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/4296-133-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download

Analysis

Sharing