webmonitor | d6593053bda046cd96e0e5e508e0f57622c464738838b84984e35e683d46c414

General

Target

fac4b5a9c4f10517f44d4ae172f6473c.exe
Size

1.9MB
MD5

fac4b5a9c4f10517f44d4ae172f6473c
SHA1

2304b22499e60fa87ea5f9d3fee5f6d9ecacf9ee
SHA256

d6593053bda046cd96e0e5e508e0f57622c464738838b84984e35e683d46c414
SHA512

6b8dc4430f6068eaac9d27e4f322d1ae921f56b9940e266ba44ed791917c37b14bb9cb1ea3b861da36d9efe44af7acf75264e19d60a5fb1e89deabd1afa1bdbc
SSDEEP

24576:qYOSCmr2OsBgo0q4wMEX1RTdVfm6ZWZmMv1XdyqTQV0QQXTMrBwtP9kvIuyR:qq/oHMEX1XVO6o91tn6IPtP9kvSR

Score

10^/10

webmonitor backdoor infostealer rat

Malware Config

Extracted

Family

webmonitor

C2

niiarmah.wm01.to:443

Attributes

config_key
4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O
private_key
yvkn5wM8E
url_path
/recv5.php

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor payload 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2908-17-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/2908-19-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/2908-18-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/2908-25-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/2908-26-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/2908-24-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/2908-29-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/2908-30-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral1/memory/2908-32-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/1996-3-0x00000000004C0000-0x00000000004D2000-memory.dmp	CustAttr

Unexpected DNS network traffic destination 8 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	185.141.152.26
Destination IP	1.2.4.8
Destination IP	1.2.4.8
Destination IP	114.114.114.114
Destination IP	185.141.152.26
Destination IP	185.141.152.26
Destination IP	185.141.152.26
Destination IP	114.114.114.114

Suspicious use of SetThreadContext 1 IoCs

Processes:

fac4b5a9c4f10517f44d4ae172f6473c.exe

description pid process target process

PID 1996 set thread context of 2908 1996 fac4b5a9c4f10517f44d4ae172f6473c.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1664 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

fac4b5a9c4f10517f44d4ae172f6473c.exe

pid process

1996 fac4b5a9c4f10517f44d4ae172f6473c.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

fac4b5a9c4f10517f44d4ae172f6473c.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1996 fac4b5a9c4f10517f44d4ae172f6473c.exe
Token: SeShutdownPrivilege 2908 RegSvcs.exe

description	pid	process	target process
PID 1996 set thread context of 2908	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe

pid	process
1664	schtasks.exe

pid	process
1996	fac4b5a9c4f10517f44d4ae172f6473c.exe

description	pid	process
Token: SeDebugPrivilege	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe
Token: SeShutdownPrivilege	2908	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

fac4b5a9c4f10517f44d4ae172f6473c.exe

description	pid	process	target process
PID 1996 wrote to memory of 1664	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	schtasks.exe
PID 1996 wrote to memory of 1664	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	schtasks.exe
PID 1996 wrote to memory of 1664	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	schtasks.exe
PID 1996 wrote to memory of 1664	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	schtasks.exe
PID 1996 wrote to memory of 2908	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 1996 wrote to memory of 2908	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 1996 wrote to memory of 2908	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 1996 wrote to memory of 2908	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 1996 wrote to memory of 2908	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 1996 wrote to memory of 2908	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 1996 wrote to memory of 2908	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 1996 wrote to memory of 2908	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 1996 wrote to memory of 2908	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 1996 wrote to memory of 2908	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 1996 wrote to memory of 2908	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 1996 wrote to memory of 2908	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 1996 wrote to memory of 2908	1996	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\fac4b5a9c4f10517f44d4ae172f6473c.exe
"C:\Users\Admin\AppData\Local\Temp\fac4b5a9c4f10517f44d4ae172f6473c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WLmzCRrQBmjpU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1D31.tmp"
2⤵
- Creates scheduled task(s)
PID:1664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2908

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1D31.tmp
Filesize
1KB

MD5
7765c5aa2ad4b814f5887b6c165f3979

SHA1
343d14d52c2d9336c1d9fe68e0fba0934473df73

SHA256
2826702ed8cfa6ea00982ebb5a604a9ceb3c764caa5379be6dc1084d7e9658df

SHA512
e6c12015d777b365033dfbc128bf0a1158b0655d66ca3fc1901f4eba86efb0caf6e797a1d71d59ac3486000f3874ddd694466ab632b21f7977d3d8ce3a3ddb74

Download Submit
memory/1996-0-0x0000000000F20000-0x0000000001118000-memory.dmp

Filesize
2.0MB

Download
memory/1996-1-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/1996-2-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download
memory/1996-3-0x00000000004C0000-0x00000000004D2000-memory.dmp

Filesize
72KB

Download
memory/1996-4-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/1996-5-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download
memory/1996-6-0x0000000005930000-0x0000000005A68000-memory.dmp

Filesize
1.2MB

Download
memory/1996-7-0x00000000052C0000-0x00000000053B4000-memory.dmp

Filesize
976KB

Download
memory/1996-27-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2908-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2908-26-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2908-15-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2908-19-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2908-18-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2908-25-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2908-13-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2908-17-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2908-24-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2908-29-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2908-30-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2908-31-0x0000000003030000-0x0000000004030000-memory.dmp

Filesize
16.0MB

Download
memory/2908-32-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2908-33-0x0000000003030000-0x0000000004030000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads