Overview

overview

10

Static

static

3

8a53427e1c...18.exe

windows7-x64

10

8a53427e1c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8a53427e1c76b904ef0daacf7c8a6ec1_JaffaCakes118

  • Size

    789KB

  • Sample

    240601-nh59ksba9v

  • MD5

    8a53427e1c76b904ef0daacf7c8a6ec1

  • SHA1

    92b2b17c7210a720e03aa0b7aada1dd4eefb48bb

  • SHA256

    ee1b9659f2193896ce3469b5f90b82af3caffcba428e8524be5a9fdf391d8dd8

  • SHA512

    d7d8871894114639891c0bfdcbb1ba1b008ab484bb70f825a355c0858d1615b15d801af6ee91304bc488fe5ac6ed3dcc6161b3bbd7f7589d25bff3e7c86a827d

  • SSDEEP

    12288:tK65z6saNnviEP5R5LlM0uVLseXcCwjHxQWJm9Hjc3w/:tKsaNiWBwNseXcCUHOAm9H//

Score
10/10
webmonitorbackdoorinfostealerpersistenceratupx

Malware Config

Extracted

Family

webmonitor

C2

barclaysb.wm01.to:443

Attributes
  • config_key

    fYgCWawbOgdOjCoFIS3awApyXAxlbcZP

  • private_key

    gbGrRRJty

  • url_path

    /recv5.php

Targets

    • Target

      8a53427e1c76b904ef0daacf7c8a6ec1_JaffaCakes118

    • Size

      789KB

    • MD5

      8a53427e1c76b904ef0daacf7c8a6ec1

    • SHA1

      92b2b17c7210a720e03aa0b7aada1dd4eefb48bb

    • SHA256

      ee1b9659f2193896ce3469b5f90b82af3caffcba428e8524be5a9fdf391d8dd8

    • SHA512

      d7d8871894114639891c0bfdcbb1ba1b008ab484bb70f825a355c0858d1615b15d801af6ee91304bc488fe5ac6ed3dcc6161b3bbd7f7589d25bff3e7c86a827d

    • SSDEEP

      12288:tK65z6saNnviEP5R5LlM0uVLseXcCwjHxQWJm9Hjc3w/:tKsaNiWBwNseXcCUHOAm9H//

    Score
    10/10
    webmonitorbackdoorinfostealerpersistenceratupx

    • RevcodeRat, WebMonitorRat

      WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

      backdoorratinfostealerwebmonitor

    • WebMonitor payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1
T1064

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks