Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 05:43
Static task
static1
Behavioral task
behavioral1
Sample
08f2609e7f7daf0f78032f773a68b72c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
08f2609e7f7daf0f78032f773a68b72c.exe
Resource
win10v2004-20231215-en
General
-
Target
08f2609e7f7daf0f78032f773a68b72c.exe
-
Size
1.4MB
-
MD5
08f2609e7f7daf0f78032f773a68b72c
-
SHA1
f00e4c61cce15ee5f43c032d8d595aba65fbdc86
-
SHA256
0ed8f93b98f9cfff89559df9e0a8d360cab3dde1abfa2992216b4a98c5ca1253
-
SHA512
8c1ba503d2956ad0c60b11547908b81e601a3bfb2c75ae73c03718bd883ff94451b0697f915049614470d59388d161c02893ad90b48466f77fc154a20215da74
-
SSDEEP
24576:abOd/OsBgo0q4wMf/5vUQgxZGCc+b8QHsDpXgbkyh1Sl+inzQSjzVrV9ZtXCU8jt:abOsoHMXpUnxZGClb8QGryPSEY79/CUw
Malware Config
Extracted
webmonitor
niiarmah.wm01.to:443
-
config_key
4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O
-
private_key
yvkn5wM8E
-
url_path
/recv5.php
Signatures
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/636-35-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral1/memory/636-39-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral1/memory/636-45-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral1/memory/636-48-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral1/memory/636-50-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral1/memory/636-32-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral1/memory/636-55-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral1/memory/636-57-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral1/memory/636-58-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor -
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral1/memory/1976-3-0x0000000000540000-0x0000000000552000-memory.dmp CustAttr -
Unexpected DNS network traffic destination 8 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 185.141.152.26 Destination IP 185.141.152.26 Destination IP 114.114.114.114 Destination IP 185.141.152.26 Destination IP 1.2.4.8 Destination IP 114.114.114.114 Destination IP 185.141.152.26 Destination IP 1.2.4.8 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
08f2609e7f7daf0f78032f773a68b72c.exedescription pid process target process PID 1976 set thread context of 636 1976 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 476 powershell.exe 2672 powershell.exe 2604 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 476 powershell.exe Token: SeDebugPrivilege 2672 powershell.exe Token: SeDebugPrivilege 2604 powershell.exe Token: SeShutdownPrivilege 636 RegSvcs.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
08f2609e7f7daf0f78032f773a68b72c.exedescription pid process target process PID 1976 wrote to memory of 2672 1976 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1976 wrote to memory of 2672 1976 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1976 wrote to memory of 2672 1976 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1976 wrote to memory of 2672 1976 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1976 wrote to memory of 2604 1976 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1976 wrote to memory of 2604 1976 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1976 wrote to memory of 2604 1976 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1976 wrote to memory of 2604 1976 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1976 wrote to memory of 2680 1976 08f2609e7f7daf0f78032f773a68b72c.exe schtasks.exe PID 1976 wrote to memory of 2680 1976 08f2609e7f7daf0f78032f773a68b72c.exe schtasks.exe PID 1976 wrote to memory of 2680 1976 08f2609e7f7daf0f78032f773a68b72c.exe schtasks.exe PID 1976 wrote to memory of 2680 1976 08f2609e7f7daf0f78032f773a68b72c.exe schtasks.exe PID 1976 wrote to memory of 476 1976 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1976 wrote to memory of 476 1976 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1976 wrote to memory of 476 1976 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1976 wrote to memory of 476 1976 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1976 wrote to memory of 636 1976 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1976 wrote to memory of 636 1976 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1976 wrote to memory of 636 1976 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1976 wrote to memory of 636 1976 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1976 wrote to memory of 636 1976 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1976 wrote to memory of 636 1976 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1976 wrote to memory of 636 1976 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1976 wrote to memory of 636 1976 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1976 wrote to memory of 636 1976 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1976 wrote to memory of 636 1976 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1976 wrote to memory of 636 1976 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1976 wrote to memory of 636 1976 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1976 wrote to memory of 636 1976 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08f2609e7f7daf0f78032f773a68b72c.exe"C:\Users\Admin\AppData\Local\Temp\08f2609e7f7daf0f78032f773a68b72c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\08f2609e7f7daf0f78032f773a68b72c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WTddvQz.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WTddvQz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCDC.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WTddvQz.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5349dca512e63d7eba00de1fee6082882
SHA108ca7030585e2e52c77978ce582c7cf5b30b4507
SHA2565da99c650a040382897e4962ecb08ae07fdb6a72ace9ff76aba5d55af9d5a228
SHA512b2c77babd00efd049ca75cddd2541fa14667cf818397b795e8ee366ecdbd6c801daeb0f09d649d7fba5673503bced1471629d65d834a7c319e400da95555893f
-
memory/476-51-0x000000006F150000-0x000000006F6FB000-memory.dmpFilesize
5.7MB
-
memory/476-47-0x00000000023D0000-0x0000000002410000-memory.dmpFilesize
256KB
-
memory/476-33-0x000000006F150000-0x000000006F6FB000-memory.dmpFilesize
5.7MB
-
memory/636-35-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/636-39-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/636-58-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/636-57-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/636-55-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/636-32-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/636-24-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/636-50-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/636-48-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/636-29-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/636-45-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/636-41-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1976-46-0x00000000743D0000-0x0000000074ABE000-memory.dmpFilesize
6.9MB
-
memory/1976-2-0x0000000004E30000-0x0000000004E70000-memory.dmpFilesize
256KB
-
memory/1976-6-0x0000000008550000-0x000000000867C000-memory.dmpFilesize
1.2MB
-
memory/1976-1-0x00000000743D0000-0x0000000074ABE000-memory.dmpFilesize
6.9MB
-
memory/1976-3-0x0000000000540000-0x0000000000552000-memory.dmpFilesize
72KB
-
memory/1976-7-0x0000000008780000-0x000000000887A000-memory.dmpFilesize
1000KB
-
memory/1976-4-0x00000000743D0000-0x0000000074ABE000-memory.dmpFilesize
6.9MB
-
memory/1976-0-0x0000000000330000-0x000000000049C000-memory.dmpFilesize
1.4MB
-
memory/1976-5-0x0000000004E30000-0x0000000004E70000-memory.dmpFilesize
256KB
-
memory/2604-30-0x0000000000220000-0x0000000000260000-memory.dmpFilesize
256KB
-
memory/2604-27-0x000000006F150000-0x000000006F6FB000-memory.dmpFilesize
5.7MB
-
memory/2604-53-0x000000006F150000-0x000000006F6FB000-memory.dmpFilesize
5.7MB
-
memory/2604-49-0x0000000000220000-0x0000000000260000-memory.dmpFilesize
256KB
-
memory/2604-34-0x0000000000220000-0x0000000000260000-memory.dmpFilesize
256KB
-
memory/2672-38-0x0000000002620000-0x0000000002660000-memory.dmpFilesize
256KB
-
memory/2672-26-0x000000006F150000-0x000000006F6FB000-memory.dmpFilesize
5.7MB
-
memory/2672-52-0x000000006F150000-0x000000006F6FB000-memory.dmpFilesize
5.7MB
-
memory/2672-28-0x000000006F150000-0x000000006F6FB000-memory.dmpFilesize
5.7MB
-
memory/2672-37-0x0000000002620000-0x0000000002660000-memory.dmpFilesize
256KB