webmonitor | d6593053bda046cd96e0e5e508e0f57622c464738838b84984e35e683d46c414

General

Target

fac4b5a9c4f10517f44d4ae172f6473c.exe
Size

1.9MB
MD5

fac4b5a9c4f10517f44d4ae172f6473c
SHA1

2304b22499e60fa87ea5f9d3fee5f6d9ecacf9ee
SHA256

d6593053bda046cd96e0e5e508e0f57622c464738838b84984e35e683d46c414
SHA512

6b8dc4430f6068eaac9d27e4f322d1ae921f56b9940e266ba44ed791917c37b14bb9cb1ea3b861da36d9efe44af7acf75264e19d60a5fb1e89deabd1afa1bdbc
SSDEEP

24576:qYOSCmr2OsBgo0q4wMEX1RTdVfm6ZWZmMv1XdyqTQV0QQXTMrBwtP9kvIuyR:qq/oHMEX1XVO6o91tn6IPtP9kvSR

Score

10^/10

webmonitor backdoor infostealer rat

Malware Config

Extracted

Family

webmonitor

C2

niiarmah.wm01.to:443

Attributes

config_key
4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O
private_key
yvkn5wM8E
url_path
/recv5.php

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4444-18-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral2/memory/4444-22-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral2/memory/4444-20-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral2/memory/4444-19-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral2/memory/4444-27-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral2/memory/5100-8-0x0000000002A20000-0x0000000002A32000-memory.dmp	CustAttr

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fac4b5a9c4f10517f44d4ae172f6473c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	fac4b5a9c4f10517f44d4ae172f6473c.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fac4b5a9c4f10517f44d4ae172f6473c.exe

description pid process target process

PID 5100 set thread context of 4444 5100 fac4b5a9c4f10517f44d4ae172f6473c.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4264 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

fac4b5a9c4f10517f44d4ae172f6473c.exe

pid process

5100 fac4b5a9c4f10517f44d4ae172f6473c.exe
5100 fac4b5a9c4f10517f44d4ae172f6473c.exe

description	pid	process	target process
PID 5100 set thread context of 4444	5100	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe

pid	process
4264	schtasks.exe

pid	process
5100	fac4b5a9c4f10517f44d4ae172f6473c.exe
5100	fac4b5a9c4f10517f44d4ae172f6473c.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

fac4b5a9c4f10517f44d4ae172f6473c.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	5100	fac4b5a9c4f10517f44d4ae172f6473c.exe
Token: SeShutdownPrivilege	4444	RegSvcs.exe
Token: SeCreatePagefilePrivilege	4444	RegSvcs.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

fac4b5a9c4f10517f44d4ae172f6473c.exeRegSvcs.exe

description	pid	process	target process
PID 5100 wrote to memory of 4264	5100	fac4b5a9c4f10517f44d4ae172f6473c.exe	schtasks.exe
PID 5100 wrote to memory of 4264	5100	fac4b5a9c4f10517f44d4ae172f6473c.exe	schtasks.exe
PID 5100 wrote to memory of 4264	5100	fac4b5a9c4f10517f44d4ae172f6473c.exe	schtasks.exe
PID 5100 wrote to memory of 4444	5100	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 5100 wrote to memory of 4444	5100	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 5100 wrote to memory of 4444	5100	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 5100 wrote to memory of 4444	5100	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 5100 wrote to memory of 4444	5100	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 5100 wrote to memory of 4444	5100	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 5100 wrote to memory of 4444	5100	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 5100 wrote to memory of 4444	5100	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 5100 wrote to memory of 4444	5100	fac4b5a9c4f10517f44d4ae172f6473c.exe	RegSvcs.exe
PID 4444 wrote to memory of 1064	4444	RegSvcs.exe	cmd.exe
PID 4444 wrote to memory of 1064	4444	RegSvcs.exe	cmd.exe
PID 4444 wrote to memory of 1064	4444	RegSvcs.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\fac4b5a9c4f10517f44d4ae172f6473c.exe
"C:\Users\Admin\AppData\Local\Temp\fac4b5a9c4f10517f44d4ae172f6473c.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WLmzCRrQBmjpU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1A2A.tmp"
2⤵
- Creates scheduled task(s)
PID:4264

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\o1y5upzFoHPjIi6d.bat" "
3⤵
PID:1064

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\o1y5upzFoHPjIi6d.bat
Filesize
204B

MD5
04361c39bd60756c1f66b8e0d1acdb14

SHA1
3290be0a986c90d6e8f67d0e315b5c65747a4736

SHA256
3f3bb2c001f96d19ca635ca11704b6923bad2c55bad5697f8ab16550c1e9f03b

SHA512
9f7712e6729fc7c9544248cfb8a593d7a526d94c544b74d5f0ff585e681331d9074524e3c7e9aaaa6c63a70da5405c2bd29942adae191886ffff417a80df9ab4

Download Submit
memory/4444-18-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4444-27-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4444-19-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4444-20-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4444-22-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/5100-10-0x00000000053A0000-0x00000000053B0000-memory.dmp

Filesize
64KB

Download
memory/5100-7-0x0000000005320000-0x0000000005376000-memory.dmp

Filesize
344KB

Download
memory/5100-8-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/5100-9-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download
memory/5100-0-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download
memory/5100-11-0x0000000006F30000-0x0000000007068000-memory.dmp

Filesize
1.2MB

Download
memory/5100-12-0x00000000070E0000-0x00000000071D4000-memory.dmp

Filesize
976KB

Download
memory/5100-6-0x00000000050D0000-0x00000000050DA000-memory.dmp

Filesize
40KB

Download
memory/5100-5-0x00000000053A0000-0x00000000053B0000-memory.dmp

Filesize
64KB

Download
memory/5100-23-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download
memory/5100-4-0x0000000005140000-0x00000000051D2000-memory.dmp

Filesize
584KB

Download
memory/5100-3-0x0000000005650000-0x0000000005BF4000-memory.dmp

Filesize
5.6MB

Download
memory/5100-2-0x0000000005000000-0x000000000509C000-memory.dmp

Filesize
624KB

Download
memory/5100-1-0x0000000000440000-0x0000000000638000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads