Analysis
-
max time kernel
152s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
25-06-2022 06:36
Static task
static1
Behavioral task
behavioral1
Sample
a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe
-
Size
1.7MB
-
MD5
9eeb9b33a63440d8b5558edf0c007db4
-
SHA1
62f57d397ef643b9c3b224cd8aebf3f988976597
-
SHA256
a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc
-
SHA512
6c1757d4956c38eb06a2aad711e3c45b58046b9856d5eb887222f061176e41ea777ae750d3ee3c82eb43433a8959057c75582ecda72324d817dac257205290b0
Malware Config
Extracted
Family
webmonitor
C2
pitbullcant.wm01.to:443
Attributes
-
config_key
A7HOB9ROz2LrVrPGPRzC4MVB2KltDr7S
-
private_key
i9KVkEro3
-
url_path
/recv5.php
Signatures
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor Payload 4 IoCs
resource yara_rule behavioral1/memory/1344-66-0x0000000000400000-0x00000000004F2000-memory.dmp family_webmonitor behavioral1/memory/1344-67-0x0000000000400000-0x00000000004F2000-memory.dmp family_webmonitor behavioral1/memory/1344-68-0x0000000000400000-0x00000000004F2000-memory.dmp family_webmonitor behavioral1/memory/1344-69-0x0000000002AB0000-0x0000000003AB0000-memory.dmp family_webmonitor -
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
-
resource yara_rule behavioral1/memory/1344-57-0x0000000000400000-0x00000000004F2000-memory.dmp upx behavioral1/memory/1344-63-0x0000000000400000-0x00000000004F2000-memory.dmp upx behavioral1/memory/1344-65-0x0000000000400000-0x00000000004F2000-memory.dmp upx behavioral1/memory/1344-66-0x0000000000400000-0x00000000004F2000-memory.dmp upx behavioral1/memory/1344-67-0x0000000000400000-0x00000000004F2000-memory.dmp upx behavioral1/memory/1344-68-0x0000000000400000-0x00000000004F2000-memory.dmp upx behavioral1/memory/1344-69-0x0000000002AB0000-0x0000000003AB0000-memory.dmp upx -
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 62.95.76.143 Destination IP 85.227.80.40 Destination IP 194.132.22.153 Destination IP 1.2.4.8 Destination IP 91.238.230.107 Destination IP 37.200.71.198 Destination IP 94.254.61.35 Destination IP 82.196.120.72 Destination IP 194.225.92.19 Destination IP 31.208.141.186 Destination IP 185.243.215.214 Destination IP 5.144.132.130 Destination IP 82.208.85.225 Destination IP 92.254.158.89 Destination IP 84.216.230.131 Destination IP 185.174.8.73 Destination IP 109.238.184.185 Destination IP 155.4.198.178 Destination IP 195.198.26.34 Destination IP 188.94.225.129 Destination IP 185.31.141.180 Destination IP 91.203.41.4 Destination IP 185.153.208.77 Destination IP 46.17.184.76 Destination IP 83.209.178.233 Destination IP 85.114.6.143 Destination IP 155.4.92.229 Destination IP 213.89.212.121 Destination IP 95.143.219.8 Destination IP 62.20.52.5 Destination IP 185.11.70.174 Destination IP 85.11.26.34 Destination IP 62.20.131.155 Destination IP 213.200.183.116 Destination IP 194.16.119.243 Destination IP 37.247.5.162 Destination IP 217.175.119.20 Destination IP 88.206.242.252 Destination IP 46.224.1.43 Destination IP 31.25.88.46 Destination IP 217.219.103.5 Destination IP 213.115.226.2 Destination IP 114.114.114.114 Destination IP 109.225.127.241 Destination IP 31.10.10.230 Destination IP 37.255.176.32 Destination IP 85.185.67.178 Destination IP 46.246.65.205 Destination IP 178.22.122.100 Destination IP 185.223.238.161 Destination IP 217.219.85.3 Destination IP 5.145.112.198 Destination IP 128.127.186.8 Destination IP 195.198.209.21 Destination IP 81.16.160.109 Destination IP 114.114.114.114 Destination IP 188.94.231.169 Destination IP 109.238.184.201 Destination IP 185.243.215.214 Destination IP 185.11.60.19 Destination IP 87.118.221.164 Destination IP 193.9.242.110 Destination IP 213.66.136.52 Destination IP 194.236.216.131 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebMonitor-3033 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-3033.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1696 set thread context of 1344 1696 a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe 29 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1344 svchost.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1696 a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe 1696 a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe 1696 a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1696 a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe 1696 a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe 1696 a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1696 wrote to memory of 1744 1696 a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe 28 PID 1696 wrote to memory of 1744 1696 a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe 28 PID 1696 wrote to memory of 1744 1696 a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe 28 PID 1696 wrote to memory of 1744 1696 a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe 28 PID 1696 wrote to memory of 1344 1696 a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe 29 PID 1696 wrote to memory of 1344 1696 a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe 29 PID 1696 wrote to memory of 1344 1696 a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe 29 PID 1696 wrote to memory of 1344 1696 a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe 29 PID 1696 wrote to memory of 1344 1696 a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe 29 PID 1696 wrote to memory of 1344 1696 a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe"C:\Users\Admin\AppData\Local\Temp\a06c169bdabb7410fef4d2b20a4c0ae0d96d268da41f496c5c013492a6b103fc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵PID:1744
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1344
-