Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 00:44
Static task
static1
Behavioral task
behavioral1
Sample
08f2609e7f7daf0f78032f773a68b72c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
08f2609e7f7daf0f78032f773a68b72c.exe
Resource
win10v2004-20231215-en
General
-
Target
08f2609e7f7daf0f78032f773a68b72c.exe
-
Size
1.4MB
-
MD5
08f2609e7f7daf0f78032f773a68b72c
-
SHA1
f00e4c61cce15ee5f43c032d8d595aba65fbdc86
-
SHA256
0ed8f93b98f9cfff89559df9e0a8d360cab3dde1abfa2992216b4a98c5ca1253
-
SHA512
8c1ba503d2956ad0c60b11547908b81e601a3bfb2c75ae73c03718bd883ff94451b0697f915049614470d59388d161c02893ad90b48466f77fc154a20215da74
-
SSDEEP
24576:abOd/OsBgo0q4wMf/5vUQgxZGCc+b8QHsDpXgbkyh1Sl+inzQSjzVrV9ZtXCU8jt:abOsoHMXpUnxZGClb8QGryPSEY79/CUw
Malware Config
Extracted
webmonitor
niiarmah.wm01.to:443
-
config_key
4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O
-
private_key
yvkn5wM8E
-
url_path
/recv5.php
Signatures
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3680-25-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral2/memory/3680-26-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral2/memory/3680-28-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral2/memory/3680-31-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral2/memory/3680-74-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor -
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral2/memory/3500-9-0x0000000001830000-0x0000000001842000-memory.dmp CustAttr -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
08f2609e7f7daf0f78032f773a68b72c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 08f2609e7f7daf0f78032f773a68b72c.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
08f2609e7f7daf0f78032f773a68b72c.exedescription pid process target process PID 3500 set thread context of 3680 3500 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
powershell.exepowershell.exe08f2609e7f7daf0f78032f773a68b72c.exepowershell.exepid process 4784 powershell.exe 4784 powershell.exe 3564 powershell.exe 3564 powershell.exe 3500 08f2609e7f7daf0f78032f773a68b72c.exe 3500 08f2609e7f7daf0f78032f773a68b72c.exe 2028 powershell.exe 2028 powershell.exe 4784 powershell.exe 2028 powershell.exe 3564 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
powershell.exepowershell.exe08f2609e7f7daf0f78032f773a68b72c.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 3564 powershell.exe Token: SeDebugPrivilege 4784 powershell.exe Token: SeDebugPrivilege 3500 08f2609e7f7daf0f78032f773a68b72c.exe Token: SeDebugPrivilege 2028 powershell.exe Token: SeShutdownPrivilege 3680 RegSvcs.exe Token: SeCreatePagefilePrivilege 3680 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
08f2609e7f7daf0f78032f773a68b72c.exeRegSvcs.exedescription pid process target process PID 3500 wrote to memory of 4784 3500 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 3500 wrote to memory of 4784 3500 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 3500 wrote to memory of 4784 3500 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 3500 wrote to memory of 3564 3500 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 3500 wrote to memory of 3564 3500 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 3500 wrote to memory of 3564 3500 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 3500 wrote to memory of 3616 3500 08f2609e7f7daf0f78032f773a68b72c.exe schtasks.exe PID 3500 wrote to memory of 3616 3500 08f2609e7f7daf0f78032f773a68b72c.exe schtasks.exe PID 3500 wrote to memory of 3616 3500 08f2609e7f7daf0f78032f773a68b72c.exe schtasks.exe PID 3500 wrote to memory of 2028 3500 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 3500 wrote to memory of 2028 3500 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 3500 wrote to memory of 2028 3500 08f2609e7f7daf0f78032f773a68b72c.exe powershell.exe PID 3500 wrote to memory of 3680 3500 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 3500 wrote to memory of 3680 3500 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 3500 wrote to memory of 3680 3500 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 3500 wrote to memory of 3680 3500 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 3500 wrote to memory of 3680 3500 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 3500 wrote to memory of 3680 3500 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 3500 wrote to memory of 3680 3500 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 3500 wrote to memory of 3680 3500 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 3500 wrote to memory of 3680 3500 08f2609e7f7daf0f78032f773a68b72c.exe RegSvcs.exe PID 3680 wrote to memory of 4752 3680 RegSvcs.exe cmd.exe PID 3680 wrote to memory of 4752 3680 RegSvcs.exe cmd.exe PID 3680 wrote to memory of 4752 3680 RegSvcs.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08f2609e7f7daf0f78032f773a68b72c.exe"C:\Users\Admin\AppData\Local\Temp\08f2609e7f7daf0f78032f773a68b72c.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\08f2609e7f7daf0f78032f773a68b72c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WTddvQz.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WTddvQz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1C77.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WTddvQz.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VhU1qJVbYZxGYCHV.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5ac0a3f3a97e7bf2e092df8d37a2c7247
SHA1b543b3032dbd3bd96d06c890041384273504e21a
SHA256892df66628a0163025ae603c650d461704f4e864285ee2e40e63276103ffa34a
SHA5121280b501a5e16899c7aa64ae3207292572b33aeebad58bd9ca8ea4fdfabd2e52c1a4776f290ed397d7aa7f83a1a29758b572bd0534153550bec81cf1641df7f9
-
C:\Users\Admin\AppData\Local\Temp\VhU1qJVbYZxGYCHV.batFilesize
204B
MD5dff7c81e7daee7da7f46d182553bbdb0
SHA1ddfb21db6d6cfe1cf23a12e4bd7141bbb4b80e12
SHA25658bf1a12fdf7990793f3b049d3937b9b8388c187a705184f6cdb846ddb963471
SHA5129e4a89e63d33637031287c5d6445d93971b0ecf3af3a35506c7cae58cf9b0f2018ee8680847c3ed7880ec0efe0107ccfe044be8857d0d5ae6aca9f70c9355fa8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xrfwrhpw.1zs.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp1C77.tmpFilesize
1KB
MD5bdaa71afa6b8024c8573f2d9311670be
SHA160a607faee3f2eff3e1cedf992961c2885896f0d
SHA25633af10e6a78bac831f511b89bf40f7129ad4f460dfb2822a62413e8eb35f1baa
SHA512e83ecbd014ef37c52e7d47604caa269039dc875381ea5ac58b8821464c262d4d56646edef398bd9847f7b8a30ae3ff2e14bbfd2cda36f40a4731d337533de9e7
-
memory/2028-115-0x0000000007ED0000-0x000000000854A000-memory.dmpFilesize
6.5MB
-
memory/2028-90-0x000000007F1D0000-0x000000007F1E0000-memory.dmpFilesize
64KB
-
memory/2028-46-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/2028-76-0x0000000006B50000-0x0000000006B82000-memory.dmpFilesize
200KB
-
memory/2028-33-0x0000000002BF0000-0x0000000002C00000-memory.dmpFilesize
64KB
-
memory/2028-78-0x0000000073170000-0x00000000731BC000-memory.dmpFilesize
304KB
-
memory/2028-55-0x0000000002BF0000-0x0000000002C00000-memory.dmpFilesize
64KB
-
memory/2028-137-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/2028-121-0x0000000002BF0000-0x0000000002C00000-memory.dmpFilesize
64KB
-
memory/2028-123-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/2028-127-0x0000000007C50000-0x0000000007C58000-memory.dmpFilesize
32KB
-
memory/2028-124-0x0000000002BF0000-0x0000000002C00000-memory.dmpFilesize
64KB
-
memory/3500-2-0x0000000005D60000-0x0000000006304000-memory.dmpFilesize
5.6MB
-
memory/3500-0-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/3500-5-0x00000000059A0000-0x00000000059B0000-memory.dmpFilesize
64KB
-
memory/3500-3-0x00000000057B0000-0x0000000005842000-memory.dmpFilesize
584KB
-
memory/3500-11-0x0000000008990000-0x0000000008A8A000-memory.dmpFilesize
1000KB
-
memory/3500-10-0x0000000008860000-0x000000000898C000-memory.dmpFilesize
1.2MB
-
memory/3500-4-0x0000000005850000-0x00000000058EC000-memory.dmpFilesize
624KB
-
memory/3500-6-0x0000000005790000-0x000000000579A000-memory.dmpFilesize
40KB
-
memory/3500-32-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/3500-9-0x0000000001830000-0x0000000001842000-memory.dmpFilesize
72KB
-
memory/3500-8-0x00000000059A0000-0x00000000059B0000-memory.dmpFilesize
64KB
-
memory/3500-1-0x0000000000C30000-0x0000000000D9C000-memory.dmpFilesize
1.4MB
-
memory/3500-7-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/3564-23-0x0000000005620000-0x0000000005630000-memory.dmpFilesize
64KB
-
memory/3564-21-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/3564-135-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/3564-44-0x0000000006290000-0x00000000062F6000-memory.dmpFilesize
408KB
-
memory/3564-66-0x00000000068E0000-0x00000000068FE000-memory.dmpFilesize
120KB
-
memory/3564-67-0x00000000069B0000-0x00000000069FC000-memory.dmpFilesize
304KB
-
memory/3564-122-0x0000000007F20000-0x0000000007F2E000-memory.dmpFilesize
56KB
-
memory/3564-24-0x0000000005620000-0x0000000005630000-memory.dmpFilesize
64KB
-
memory/3564-118-0x0000000005620000-0x0000000005630000-memory.dmpFilesize
64KB
-
memory/3564-91-0x0000000006F30000-0x0000000006F4E000-memory.dmpFilesize
120KB
-
memory/3564-113-0x0000000007B70000-0x0000000007C13000-memory.dmpFilesize
652KB
-
memory/3564-77-0x0000000073170000-0x00000000731BC000-memory.dmpFilesize
304KB
-
memory/3564-111-0x0000000005620000-0x0000000005630000-memory.dmpFilesize
64KB
-
memory/3564-29-0x0000000005BB0000-0x0000000005BD2000-memory.dmpFilesize
136KB
-
memory/3564-80-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/3564-101-0x000000007EEB0000-0x000000007EEC0000-memory.dmpFilesize
64KB
-
memory/3680-28-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/3680-31-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/3680-25-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/3680-26-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/3680-74-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/4784-120-0x0000000007430000-0x0000000007441000-memory.dmpFilesize
68KB
-
memory/4784-68-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/4784-114-0x000000007FDF0000-0x000000007FE00000-memory.dmpFilesize
64KB
-
memory/4784-116-0x00000000061E0000-0x00000000061FA000-memory.dmpFilesize
104KB
-
memory/4784-117-0x00000000072A0000-0x00000000072AA000-memory.dmpFilesize
40KB
-
memory/4784-71-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4784-119-0x00000000074B0000-0x0000000007546000-memory.dmpFilesize
600KB
-
memory/4784-75-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4784-70-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4784-92-0x0000000073170000-0x00000000731BC000-memory.dmpFilesize
304KB
-
memory/4784-65-0x0000000005A30000-0x0000000005D84000-memory.dmpFilesize
3.3MB
-
memory/4784-20-0x00000000051B0000-0x00000000057D8000-memory.dmpFilesize
6.2MB
-
memory/4784-125-0x0000000007590000-0x00000000075A4000-memory.dmpFilesize
80KB
-
memory/4784-126-0x00000000075F0000-0x000000000760A000-memory.dmpFilesize
104KB
-
memory/4784-19-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4784-18-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/4784-16-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/4784-136-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/4784-14-0x00000000025D0000-0x0000000002606000-memory.dmpFilesize
216KB
-
memory/4784-45-0x00000000058C0000-0x0000000005926000-memory.dmpFilesize
408KB