webmonitor | 962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325

General

Target

962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe
Size

464KB
MD5

aa520f2696f367cb29c57b30155642b9
SHA1

828ad17ed10adc878d15c19c68f7c64b8d77e817
SHA256

962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325
SHA512

f73a064b388c55d94b64df5680539a21beaca0faa5134a4cc8d6742383c018bb535b3a1e8b0b5b8b515fa73525a33a940289dd729041a4a2ef75539b4bdc424b

Score

10^/10

webmonitor backdoor infostealer persistence rat upx

Malware Config

Extracted

Family

webmonitor

C2

zmason.wm01.to:443

Attributes

config_key
IW7RY6byfRU3eXbO5N3y8WsOQsZPXyHX
private_key
ITr9B50EB
url_path
/recv4.php

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\D6NiKPzMGRWcW4Aw\\sYOpZZ1WnTG7.exe\",explorer.exe"	962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2044-68-0x0000000000400000-0x00000000004C1000-memory.dmp	family_webmonitor
behavioral1/memory/2044-69-0x0000000000400000-0x00000000004C1000-memory.dmp	family_webmonitor
behavioral1/memory/2044-71-0x0000000000400000-0x00000000004C1000-memory.dmp	family_webmonitor

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2044-58-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral1/memory/2044-60-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral1/memory/2044-61-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral1/memory/2044-63-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral1/memory/2044-64-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral1/memory/2044-67-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral1/memory/2044-68-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral1/memory/2044-69-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral1/memory/2044-71-0x0000000000400000-0x00000000004C1000-memory.dmp	upx

Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 185.243.215.214

description	ioc
Destination IP	185.243.215.214

Suspicious use of SetThreadContext 1 IoCs

Processes:

962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe

description	pid	process	target process
PID 1716 set thread context of 2044	1716	962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe

pid process

1716 962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe

pid	process
1716	962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe

description	pid	process
Token: SeDebugPrivilege	1716	962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe
Token: SeDebugPrivilege	1716	962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe

description	pid	process	target process
PID 1716 wrote to memory of 2044	1716	962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe	AppLaunch.exe
PID 1716 wrote to memory of 2044	1716	962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe	AppLaunch.exe
PID 1716 wrote to memory of 2044	1716	962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe	AppLaunch.exe
PID 1716 wrote to memory of 2044	1716	962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe	AppLaunch.exe
PID 1716 wrote to memory of 2044	1716	962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe	AppLaunch.exe
PID 1716 wrote to memory of 2044	1716	962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe	AppLaunch.exe
PID 1716 wrote to memory of 2044	1716	962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe	AppLaunch.exe
PID 1716 wrote to memory of 2044	1716	962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe	AppLaunch.exe
PID 1716 wrote to memory of 2044	1716	962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe	AppLaunch.exe
PID 1716 wrote to memory of 2044	1716	962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe	AppLaunch.exe
PID 1716 wrote to memory of 2044	1716	962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe
"C:\Users\Admin\AppData\Local\Temp\962f2ac175ba0c195841cab9895cb56c41ddcb78d010a85e87f8d4fd2a3f2325.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1716-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1716-55-0x0000000074D40000-0x00000000752EB000-memory.dmp

Filesize
5.7MB

Download
memory/1716-56-0x0000000074D40000-0x00000000752EB000-memory.dmp

Filesize
5.7MB

Download
memory/1716-70-0x0000000074D40000-0x00000000752EB000-memory.dmp

Filesize
5.7MB

Download
memory/2044-61-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2044-60-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2044-58-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2044-62-0x00000000004BFBF0-mapping.dmp

Download
memory/2044-63-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2044-64-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2044-67-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2044-68-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2044-69-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2044-57-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2044-71-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads