Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16-05-2024 17:41
General
-
Target
Extreme Injector v3.7.exe
-
Size
365KB
-
MD5
1250fbb9be09180d07d87d1abdc2b349
-
SHA1
c58da16d2e16955498b083bf5d5a55a4cccf32fe
-
SHA256
8979b90d56e060696bcd2f0e36f2c0a10c7ccab4114bfce1bb278bf25ecc2946
-
SHA512
ffe323afa8b5ae6d574dff789dd2b42d0ce80581e47648425fc3b57873092f2ee38dcdb17e45e601803ffd4c806f38fcfaf5d785bbb8a1657f71fde980dcedb1
-
SSDEEP
6144:cxLA03giVtLfLzHbklDubM1oFRgfHaSjcVfUpJqTyZp0KfgxcFmQoZgfHlgASbyz:cxLA4tLf37ktu2qg/aSjosL4Kfgo5oZ2
Malware Config
Extracted
webmonitor
kamilw1337.wm01.to:443
-
config_key
a72oDI537AbYRjeItTOo34O25nOyaPFK
-
private_key
MqUzv9esY
-
url_path
/recv5.php
Signatures
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor payload 7 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.7.exe"C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.7.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
984KB
-
Filesize
16.0MB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB