Analysis
-
max time kernel
138s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-12-2024 03:02
Static task
static1
Behavioral task
behavioral1
Sample
STATEMENT OF ACCOUNT.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
STATEMENT OF ACCOUNT.exe
Resource
win10v2004-20241007-en
General
-
Target
STATEMENT OF ACCOUNT.exe
-
Size
962KB
-
MD5
d39da4595ca51a748ac33447965d80e3
-
SHA1
e7e0ec21e7cb1d67c906169e6e039d4b29c423c7
-
SHA256
77732e74850050bb6f935945e510d32a0499d820fa1197752df8bd01c66e8210
-
SHA512
620cf557f657213ff9f52b2939fdd689906f4b634a20210d3a6062802b25e30d3085c3b6bf0336c880fa8deedafc67f4daee2dd999f911d86184bda47d3ba178
-
SSDEEP
24576:0FsVd+29QFw53L5o3DVUYR35Xc32WBjshPQ:0FsqtFwaFi3JX
Malware Config
Extracted
webmonitor
niiarmah.wm01.to:443
-
config_key
4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O
-
private_key
yvkn5wM8E
-
url_path
/recv5.php
Signatures
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor payload 6 IoCs
resource yara_rule behavioral1/memory/1020-3-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral1/memory/1020-5-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral1/memory/1020-6-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral1/memory/1020-7-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral1/memory/1020-10-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral1/memory/1020-11-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor -
Webmonitor family
-
Unexpected DNS network traffic destination 8 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 185.141.152.26 Destination IP 185.141.152.26 Destination IP 1.2.4.8 Destination IP 1.2.4.8 Destination IP 114.114.114.114 Destination IP 114.114.114.114 Destination IP 185.141.152.26 Destination IP 185.141.152.26 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2964 set thread context of 1020 2964 STATEMENT OF ACCOUNT.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STATEMENT OF ACCOUNT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STATEMENT OF ACCOUNT.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2964 STATEMENT OF ACCOUNT.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1020 STATEMENT OF ACCOUNT.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2964 wrote to memory of 1020 2964 STATEMENT OF ACCOUNT.exe 30 PID 2964 wrote to memory of 1020 2964 STATEMENT OF ACCOUNT.exe 30 PID 2964 wrote to memory of 1020 2964 STATEMENT OF ACCOUNT.exe 30 PID 2964 wrote to memory of 1020 2964 STATEMENT OF ACCOUNT.exe 30 PID 2964 wrote to memory of 1020 2964 STATEMENT OF ACCOUNT.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1020
-