webmonitor | 167f23bd6318e7e1bbe296639468d866b2b457410daab0e6b941dac6bcc4563f

General

Target

a3a62c034f2eb97d3673d2a608073f7e.exe
Size

1.8MB
MD5

a3a62c034f2eb97d3673d2a608073f7e
SHA1

250644fc77d95c6dcaef531b0f351f5ce33bbfbd
SHA256

167f23bd6318e7e1bbe296639468d866b2b457410daab0e6b941dac6bcc4563f
SHA512

16c0b478ea9f1fcdeb9c13af022ac0f18879798eb7715aabd93446630dd0b9e3e9c3c1e31114657623c9c932502b99f41c1f3c52ede0306311f729810366ed71
SSDEEP

49152:y4bKFBaK648EFZ6hBYiYsQvoQhTnAYD6Xa:yOK+AZIBYi/coQl

Score

10^/10

webmonitor backdoor infostealer rat

Malware Config

Extracted

Family

webmonitor

C2

niiarmah.wm01.to:443

Attributes

config_key
4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O
private_key
yvkn5wM8E
url_path
/recv5.php

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2692-27-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/1984-3-0x0000000000310000-0x0000000000322000-memory.dmp	CustAttr

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1748 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2496 powershell.exe
2492 powershell.exe
1200 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2496 powershell.exe
Token: SeDebugPrivilege 1200 powershell.exe
Token: SeDebugPrivilege 2492 powershell.exe

pid	process
1748	schtasks.exe

pid	process
2496	powershell.exe
2492	powershell.exe
1200	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

a3a62c034f2eb97d3673d2a608073f7e.exe

description	pid	process	target process
PID 1984 wrote to memory of 2496	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	powershell.exe
PID 1984 wrote to memory of 2496	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	powershell.exe
PID 1984 wrote to memory of 2496	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	powershell.exe
PID 1984 wrote to memory of 2496	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	powershell.exe
PID 1984 wrote to memory of 2492	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	powershell.exe
PID 1984 wrote to memory of 2492	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	powershell.exe
PID 1984 wrote to memory of 2492	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	powershell.exe
PID 1984 wrote to memory of 2492	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	powershell.exe
PID 1984 wrote to memory of 1748	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	schtasks.exe
PID 1984 wrote to memory of 1748	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	schtasks.exe
PID 1984 wrote to memory of 1748	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	schtasks.exe
PID 1984 wrote to memory of 1748	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	schtasks.exe
PID 1984 wrote to memory of 1200	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	powershell.exe
PID 1984 wrote to memory of 1200	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	powershell.exe
PID 1984 wrote to memory of 1200	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	powershell.exe
PID 1984 wrote to memory of 1200	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	powershell.exe
PID 1984 wrote to memory of 2692	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	RegSvcs.exe
PID 1984 wrote to memory of 2692	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	RegSvcs.exe
PID 1984 wrote to memory of 2692	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	RegSvcs.exe
PID 1984 wrote to memory of 2692	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	RegSvcs.exe
PID 1984 wrote to memory of 2692	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	RegSvcs.exe
PID 1984 wrote to memory of 2692	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	RegSvcs.exe
PID 1984 wrote to memory of 2692	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	RegSvcs.exe
PID 1984 wrote to memory of 2692	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	RegSvcs.exe
PID 1984 wrote to memory of 2692	1984	a3a62c034f2eb97d3673d2a608073f7e.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\a3a62c034f2eb97d3673d2a608073f7e.exe
"C:\Users\Admin\AppData\Local\Temp\a3a62c034f2eb97d3673d2a608073f7e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a3a62c034f2eb97d3673d2a608073f7e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2496

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CJFickSnic.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CJFickSnic" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCBC7.tmp"
2⤵
- Creates scheduled task(s)
PID:1748

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CJFickSnic.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:2692

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCBC7.tmp
Filesize
1KB

MD5
424f2d0f1b25ce078e8c8c199beb8726

SHA1
34357aa0f9a4925b6a5db9225010e302c26a63bd

SHA256
05b4d71bc61538c7fd803031726139a29316419bad6d8ac0839e8bdd6851a48e

SHA512
b0a6393746ce483851dd50757c84a60f3ab277595048d86b38ee1a2d13078cf7b6bbdc17d045ead4f9228aee54747cc0dc6f3909a2f0edd1e73faa9cc4454a9a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9V8DNG4GBF9QF10N41XE.temp
Filesize
7KB

MD5
e5382fba94e2b693dffbb20dd65cdb47

SHA1
fa97bfb28a2e710a9281308dd88ed4f945d3e1cd

SHA256
6968e323ff6bdcad24c419c6cd0347aa8f5a2bccec5c4f661972e48cf9d257e8

SHA512
dabddbd8076c76183e60bb4cd3bea4e620fc174edc136af62ec6b7730a18f22fb68930dbafc211c01b16632c47de0bf24e6e02340dc4eb3f6a1412dbaca88463

Download Submit
memory/1200-42-0x000000006DA50000-0x000000006DFFB000-memory.dmp

Filesize
5.7MB

Download
memory/1200-36-0x000000006DA50000-0x000000006DFFB000-memory.dmp

Filesize
5.7MB

Download
memory/1984-0-0x0000000000C70000-0x0000000000E4A000-memory.dmp

Filesize
1.9MB

Download
memory/1984-1-0x0000000073FE0000-0x00000000746CE000-memory.dmp

Filesize
6.9MB

Download
memory/1984-2-0x00000000006D0000-0x0000000000710000-memory.dmp

Filesize
256KB

Download
memory/1984-3-0x0000000000310000-0x0000000000322000-memory.dmp

Filesize
72KB

Download
memory/1984-4-0x0000000073FE0000-0x00000000746CE000-memory.dmp

Filesize
6.9MB

Download
memory/1984-5-0x00000000006D0000-0x0000000000710000-memory.dmp

Filesize
256KB

Download
memory/1984-6-0x0000000005D80000-0x0000000005EBC000-memory.dmp

Filesize
1.2MB

Download
memory/1984-7-0x0000000007E30000-0x0000000007F24000-memory.dmp

Filesize
976KB

Download
memory/2492-34-0x0000000002A40000-0x0000000002A80000-memory.dmp

Filesize
256KB

Download
memory/2492-38-0x0000000002A40000-0x0000000002A80000-memory.dmp

Filesize
256KB

Download
memory/2492-30-0x000000006DA50000-0x000000006DFFB000-memory.dmp

Filesize
5.7MB

Download
memory/2492-41-0x000000006DA50000-0x000000006DFFB000-memory.dmp

Filesize
5.7MB

Download
memory/2492-32-0x000000006DA50000-0x000000006DFFB000-memory.dmp

Filesize
5.7MB

Download
memory/2492-39-0x0000000002A40000-0x0000000002A80000-memory.dmp

Filesize
256KB

Download
memory/2496-35-0x0000000002C90000-0x0000000002CD0000-memory.dmp

Filesize
256KB

Download
memory/2496-37-0x0000000002C90000-0x0000000002CD0000-memory.dmp

Filesize
256KB

Download
memory/2496-29-0x000000006DA50000-0x000000006DFFB000-memory.dmp

Filesize
5.7MB

Download
memory/2496-33-0x000000006DA50000-0x000000006DFFB000-memory.dmp

Filesize
5.7MB

Download
memory/2496-40-0x000000006DA50000-0x000000006DFFB000-memory.dmp

Filesize
5.7MB

Download
memory/2496-31-0x0000000002C90000-0x0000000002CD0000-memory.dmp

Filesize
256KB

Download
memory/2692-27-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2692-22-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2692-21-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads