Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
-
submitted
25-07-2022 02:25
General
-
Target
ea419643de9a10a418292f1603f86bab0942f436af5e7a8309351ce552e68d2b.exe
-
Size
365KB
-
MD5
af76619743662c5e9ccfaa1f940b8354
-
SHA1
bf8e2c7b4a84ca177d7ae9c4ba6155d2dbc74b38
-
SHA256
ea419643de9a10a418292f1603f86bab0942f436af5e7a8309351ce552e68d2b
-
SHA512
be9eaaadc9cf5509e301c9908e555b2ac0dbf984aede52545a78b98ce459f222050e1d0fc01aa4afdca275d921f79c972b325de55a9d91285c1298e6b5291373
Malware Config
Extracted
webmonitor
primeservers1.wm01.to:443
-
config_key
AP8PrfNym8htAX0Za6LL12tdOuH5BSPp
-
private_key
U6yRoBXHU
-
url_path
/recv5.php
Signatures
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor payload 3 IoCs
-
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 8 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea419643de9a10a418292f1603f86bab0942f436af5e7a8309351ce552e68d2b.exe"C:\Users\Admin\AppData\Local\Temp\ea419643de9a10a418292f1603f86bab0942f436af5e7a8309351ce552e68d2b.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
984KB
-
Filesize
16.0MB
-
Filesize
984KB
-
Filesize
16.0MB