webmonitor | 17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80

General

Target

8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe
Size

840KB
MD5

8a2123d4809ffdc677df37b88d58769c
SHA1

4138f2da78ccf7ed3a07d455fddb367f59568d04
SHA256

17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80
SHA512

632870596e6f41adefce8a6589ee75b9df1ab483e619d2a2e555f6878a48007c5a38267c576ef3b056559d5348994427e46690034a59388aeee910f4fa93f671
SSDEEP

12288:juCJUOVMQGZGlScgjAFai8/6CAYUNifucTSkPjQMS/kkkkkkk:jNJUOVbocgjA58SCAi2jkPh

Score

10^/10

webmonitor backdoor infostealer persistence rat upx

Malware Config

Extracted

Family

webmonitor

C2

mafianclub.wm01.to:443

Attributes

config_key
msK8483mYp1k2OzxD1I3yoSUcNW7v1k5
private_key
WB8PgMeHa
url_path
/recv5.php

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2436-13-0x0000000000400000-0x00000000004F6000-memory.dmp	family_webmonitor
behavioral1/memory/2436-14-0x0000000000400000-0x00000000004F6000-memory.dmp	family_webmonitor
behavioral1/memory/2436-16-0x0000000000400000-0x00000000004F6000-memory.dmp	family_webmonitor
behavioral1/memory/2436-20-0x0000000000400000-0x00000000004F6000-memory.dmp	family_webmonitor
behavioral1/memory/2436-19-0x0000000000400000-0x00000000004F6000-memory.dmp	family_webmonitor

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2436-7-0x0000000000400000-0x00000000004F6000-memory.dmp	upx
behavioral1/memory/2436-8-0x0000000000400000-0x00000000004F6000-memory.dmp	upx
behavioral1/memory/2436-10-0x0000000000400000-0x00000000004F6000-memory.dmp	upx
behavioral1/memory/2436-12-0x0000000000400000-0x00000000004F6000-memory.dmp	upx
behavioral1/memory/2436-13-0x0000000000400000-0x00000000004F6000-memory.dmp	upx
behavioral1/memory/2436-14-0x0000000000400000-0x00000000004F6000-memory.dmp	upx
behavioral1/memory/2436-16-0x0000000000400000-0x00000000004F6000-memory.dmp	upx
behavioral1/memory/2436-20-0x0000000000400000-0x00000000004F6000-memory.dmp	upx
behavioral1/memory/2436-19-0x0000000000400000-0x00000000004F6000-memory.dmp	upx

Unexpected DNS network traffic destination 7 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	185.141.152.26
Destination IP	1.2.4.8
Destination IP	185.141.152.26
Destination IP	114.114.114.114
Destination IP	185.141.152.26
Destination IP	1.2.4.8
Destination IP	114.114.114.114

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RegAsm.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebMonitor-4dd3 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-4dd3.exe"	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe

description pid process target process

PID 2872 set thread context of 2436 2872 8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe RegAsm.exe

description	pid	process	target process
PID 2872 set thread context of 2436	2872	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe

pid	process
2872	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe
2872	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe
2872	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 2872 8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe
Token: SeShutdownPrivilege 2436 RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2872	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe
Token: SeShutdownPrivilege	2436	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe

description	pid	process	target process
PID 2872 wrote to memory of 2436	2872	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe	RegAsm.exe
PID 2872 wrote to memory of 2436	2872	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe	RegAsm.exe
PID 2872 wrote to memory of 2436	2872	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe	RegAsm.exe
PID 2872 wrote to memory of 2436	2872	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe	RegAsm.exe
PID 2872 wrote to memory of 2436	2872	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe	RegAsm.exe
PID 2872 wrote to memory of 2436	2872	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe	RegAsm.exe
PID 2872 wrote to memory of 2436	2872	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe	RegAsm.exe
PID 2872 wrote to memory of 2436	2872	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe	RegAsm.exe
PID 2872 wrote to memory of 2436	2872	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe	RegAsm.exe
PID 2872 wrote to memory of 2436	2872	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe	RegAsm.exe
PID 2872 wrote to memory of 2436	2872	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe	RegAsm.exe
PID 2872 wrote to memory of 2436	2872	8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8a2123d4809ffdc677df37b88d58769c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2436-16-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2436-12-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2436-8-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2436-20-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2436-17-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2436-14-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2436-13-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2436-10-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2436-19-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2436-18-0x0000000002EB0000-0x0000000003EB0000-memory.dmp

Filesize
16.0MB

Download
memory/2436-7-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2872-5-0x0000000074330000-0x0000000074A1E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-6-0x0000000074330000-0x0000000074A1E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-15-0x0000000074330000-0x0000000074A1E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-1-0x0000000000040000-0x0000000000118000-memory.dmp

Filesize
864KB

Download
memory/2872-0-0x000000007433E000-0x000000007433F000-memory.dmp

Filesize
4KB

Download
memory/2872-4-0x000000007433E000-0x000000007433F000-memory.dmp

Filesize
4KB

Download
memory/2872-9-0x0000000074330000-0x0000000074A1E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-3-0x0000000074330000-0x0000000074A1E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-2-0x00000000005B0000-0x00000000005C8000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads