Analysis
-
max time kernel
47s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 05:43
Static task
static1
Behavioral task
behavioral1
Sample
08f2609e7f7daf0f78032f773a68b72c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
08f2609e7f7daf0f78032f773a68b72c.exe
Resource
win10v2004-20231215-en
General
-
Target
08f2609e7f7daf0f78032f773a68b72c.exe
-
Size
1.4MB
-
MD5
08f2609e7f7daf0f78032f773a68b72c
-
SHA1
f00e4c61cce15ee5f43c032d8d595aba65fbdc86
-
SHA256
0ed8f93b98f9cfff89559df9e0a8d360cab3dde1abfa2992216b4a98c5ca1253
-
SHA512
8c1ba503d2956ad0c60b11547908b81e601a3bfb2c75ae73c03718bd883ff94451b0697f915049614470d59388d161c02893ad90b48466f77fc154a20215da74
-
SSDEEP
24576:abOd/OsBgo0q4wMf/5vUQgxZGCc+b8QHsDpXgbkyh1Sl+inzQSjzVrV9ZtXCU8jt:abOsoHMXpUnxZGClb8QGryPSEY79/CUw
Malware Config
Extracted
webmonitor
niiarmah.wm01.to:443
-
config_key
4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O
-
private_key
yvkn5wM8E
-
url_path
/recv5.php
Signatures
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1136-47-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral2/memory/1136-50-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral2/memory/1136-51-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral2/memory/1136-48-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral2/memory/1136-129-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor -
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral2/memory/1592-7-0x0000000005020000-0x0000000005032000-memory.dmp CustAttr -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
08f2609e7f7daf0f78032f773a68b72c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation 08f2609e7f7daf0f78032f773a68b72c.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
08f2609e7f7daf0f78032f773a68b72c.exedescription pid process target process PID 1592 set thread context of 1136 1592 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
powershell.exepowershell.exe08f2609e7f7daf0f78032f773a68b72c.exepowershell.exepid process 4552 powershell.exe 4552 powershell.exe 4364 powershell.exe 4364 powershell.exe 1592 08f2609e7f7daf0f78032f773a68b72c.exe 1592 08f2609e7f7daf0f78032f773a68b72c.exe 3532 powershell.exe 3532 powershell.exe 4552 powershell.exe 4364 powershell.exe 3532 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exe08f2609e7f7daf0f78032f773a68b72c.exepowershell.exedescription pid process Token: SeDebugPrivilege 4364 powershell.exe Token: SeDebugPrivilege 4552 powershell.exe Token: SeDebugPrivilege 1592 08f2609e7f7daf0f78032f773a68b72c.exe Token: SeDebugPrivilege 3532 powershell.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
08f2609e7f7daf0f78032f773a68b72c.exedescription pid process target process PID 1592 wrote to memory of 4364 1592 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1592 wrote to memory of 4364 1592 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1592 wrote to memory of 4364 1592 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1592 wrote to memory of 4552 1592 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1592 wrote to memory of 4552 1592 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1592 wrote to memory of 4552 1592 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1592 wrote to memory of 3948 1592 08f2609e7f7daf0f78032f773a68b72c.exe schtasks.exe PID 1592 wrote to memory of 3948 1592 08f2609e7f7daf0f78032f773a68b72c.exe schtasks.exe PID 1592 wrote to memory of 3948 1592 08f2609e7f7daf0f78032f773a68b72c.exe schtasks.exe PID 1592 wrote to memory of 3532 1592 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1592 wrote to memory of 3532 1592 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1592 wrote to memory of 3532 1592 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 1592 wrote to memory of 1136 1592 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1592 wrote to memory of 1136 1592 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1592 wrote to memory of 1136 1592 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1592 wrote to memory of 1136 1592 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1592 wrote to memory of 1136 1592 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1592 wrote to memory of 1136 1592 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1592 wrote to memory of 1136 1592 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1592 wrote to memory of 1136 1592 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 1592 wrote to memory of 1136 1592 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08f2609e7f7daf0f78032f773a68b72c.exe"C:\Users\Admin\AppData\Local\Temp\08f2609e7f7daf0f78032f773a68b72c.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\08f2609e7f7daf0f78032f773a68b72c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WTddvQz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF443.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CrfH3AZGAkLBEj7z.bat" "3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WTddvQz.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WTddvQz.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1136-47-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/1136-48-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/1136-51-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/1136-129-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/1136-50-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/1592-1-0x0000000000AA0000-0x0000000000C0C000-memory.dmpFilesize
1.4MB
-
memory/1592-6-0x00000000056B0000-0x00000000056BA000-memory.dmpFilesize
40KB
-
memory/1592-7-0x0000000005020000-0x0000000005032000-memory.dmpFilesize
72KB
-
memory/1592-8-0x0000000075250000-0x0000000075A00000-memory.dmpFilesize
7.7MB
-
memory/1592-9-0x0000000005970000-0x0000000005980000-memory.dmpFilesize
64KB
-
memory/1592-10-0x0000000008C50000-0x0000000008D7C000-memory.dmpFilesize
1.2MB
-
memory/1592-11-0x0000000008D80000-0x0000000008E7A000-memory.dmpFilesize
1000KB
-
memory/1592-5-0x0000000005970000-0x0000000005980000-memory.dmpFilesize
64KB
-
memory/1592-52-0x0000000075250000-0x0000000075A00000-memory.dmpFilesize
7.7MB
-
memory/1592-4-0x0000000005740000-0x00000000057DC000-memory.dmpFilesize
624KB
-
memory/1592-0-0x0000000075250000-0x0000000075A00000-memory.dmpFilesize
7.7MB
-
memory/1592-2-0x0000000005BB0000-0x0000000006154000-memory.dmpFilesize
5.6MB
-
memory/1592-3-0x0000000005600000-0x0000000005692000-memory.dmpFilesize
584KB
-
memory/3532-125-0x0000000075250000-0x0000000075A00000-memory.dmpFilesize
7.7MB
-
memory/3532-109-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/3532-54-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/3532-55-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/3532-53-0x0000000075250000-0x0000000075A00000-memory.dmpFilesize
7.7MB
-
memory/3532-99-0x0000000075AE0000-0x0000000075B2C000-memory.dmpFilesize
304KB
-
memory/4364-24-0x0000000005810000-0x0000000005876000-memory.dmpFilesize
408KB
-
memory/4364-17-0x0000000075250000-0x0000000075A00000-memory.dmpFilesize
7.7MB
-
memory/4364-42-0x0000000005AA0000-0x0000000005DF4000-memory.dmpFilesize
3.3MB
-
memory/4364-22-0x0000000002780000-0x0000000002790000-memory.dmpFilesize
64KB
-
memory/4364-27-0x0000000005930000-0x0000000005996000-memory.dmpFilesize
408KB
-
memory/4364-113-0x00000000075C0000-0x00000000075D4000-memory.dmpFilesize
80KB
-
memory/4364-19-0x0000000005170000-0x0000000005798000-memory.dmpFilesize
6.2MB
-
memory/4364-112-0x00000000075B0000-0x00000000075BE000-memory.dmpFilesize
56KB
-
memory/4364-18-0x0000000002780000-0x0000000002790000-memory.dmpFilesize
64KB
-
memory/4364-118-0x0000000075250000-0x0000000075A00000-memory.dmpFilesize
7.7MB
-
memory/4364-69-0x000000007F040000-0x000000007F050000-memory.dmpFilesize
64KB
-
memory/4364-67-0x0000000006FF0000-0x0000000007022000-memory.dmpFilesize
200KB
-
memory/4364-70-0x0000000075AE0000-0x0000000075B2C000-memory.dmpFilesize
304KB
-
memory/4364-94-0x0000000002780000-0x0000000002790000-memory.dmpFilesize
64KB
-
memory/4364-98-0x00000000073F0000-0x00000000073FA000-memory.dmpFilesize
40KB
-
memory/4364-96-0x00000000079C0000-0x000000000803A000-memory.dmpFilesize
6.5MB
-
memory/4364-93-0x0000000002780000-0x0000000002790000-memory.dmpFilesize
64KB
-
memory/4364-91-0x0000000007250000-0x00000000072F3000-memory.dmpFilesize
652KB
-
memory/4364-16-0x0000000002730000-0x0000000002766000-memory.dmpFilesize
216KB
-
memory/4552-21-0x00000000021A0000-0x00000000021B0000-memory.dmpFilesize
64KB
-
memory/4552-110-0x0000000006FE0000-0x0000000007076000-memory.dmpFilesize
600KB
-
memory/4552-97-0x0000000006D60000-0x0000000006D7A000-memory.dmpFilesize
104KB
-
memory/4552-111-0x0000000006F60000-0x0000000006F71000-memory.dmpFilesize
68KB
-
memory/4552-90-0x000000007F6E0000-0x000000007F6F0000-memory.dmpFilesize
64KB
-
memory/4552-95-0x00000000021A0000-0x00000000021B0000-memory.dmpFilesize
64KB
-
memory/4552-92-0x00000000021A0000-0x00000000021B0000-memory.dmpFilesize
64KB
-
memory/4552-80-0x0000000005FF0000-0x000000000600E000-memory.dmpFilesize
120KB
-
memory/4552-20-0x00000000021A0000-0x00000000021B0000-memory.dmpFilesize
64KB
-
memory/4552-114-0x00000000070A0000-0x00000000070BA000-memory.dmpFilesize
104KB
-
memory/4552-115-0x0000000007080000-0x0000000007088000-memory.dmpFilesize
32KB
-
memory/4552-23-0x0000000004950000-0x0000000004972000-memory.dmpFilesize
136KB
-
memory/4552-68-0x0000000075AE0000-0x0000000075B2C000-memory.dmpFilesize
304KB
-
memory/4552-122-0x0000000075250000-0x0000000075A00000-memory.dmpFilesize
7.7MB
-
memory/4552-26-0x0000000075250000-0x0000000075A00000-memory.dmpFilesize
7.7MB
-
memory/4552-66-0x0000000005AC0000-0x0000000005B0C000-memory.dmpFilesize
304KB
-
memory/4552-65-0x0000000005A30000-0x0000000005A4E000-memory.dmpFilesize
120KB