Analysis
- max time kernel
151s - max time network
147s - platform
windows10_x64 - resource
win10v20201028 - submitted
11/11/2020, 10:55
Static task
static1
Behavioral task
behavioral1
Sample
2f7c799eb16f3ee23dea72b7aa2ff3797b797c6060d5d23fe424b80e36ff10c8.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2f7c799eb16f3ee23dea72b7aa2ff3797b797c6060d5d23fe424b80e36ff10c8.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 2f7c799eb16f3ee23dea72b7aa2ff3797b797c6060d5d23fe424b80e36ff10c8.exe
- Size 488KB
- Sample201111-c47bqacb1x
- SHA256 2f7c799eb16f3ee23dea72b7aa2ff3797b797c6060d5d23fe424b80e36ff10c8
- MD5 bffc0d6b27477882ca2535a9ce229109
- SHA1 71b5f308eeb34f18cc79ebcfa7a568560ba47cb2
- SHA512 6bf0bdfa9ab12af8727e9c2c8b8bd2f02753280de49555cc3b6ef95a139b76b139b139bab34a7a782e970b8122b1dcedb0bcbe1822efdf9536834ece5a566a2b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- WSHRAT Payload 1 IoCs
resource yara_rule behavioral2/files/0x000100000001ab77-6.dat family_wshrat - Blacklisted process makes network request 25 IoCs
flow pid Process 19 1928 wscript.exe 21 1928 wscript.exe 22 1928 wscript.exe 24 1928 wscript.exe 25 1928 wscript.exe 26 1928 wscript.exe 28 1928 wscript.exe 29 1928 wscript.exe 30 1928 wscript.exe 31 1928 wscript.exe 32 1928 wscript.exe 33 1928 wscript.exe 34 1928 wscript.exe 35 1928 wscript.exe 37 1928 wscript.exe 38 1928 wscript.exe 39 1928 wscript.exe 40 1928 wscript.exe 41 1928 wscript.exe 42 1928 wscript.exe 43 1928 wscript.exe 44 1928 wscript.exe 45 1928 wscript.exe 46 1928 wscript.exe 47 1928 wscript.exe - Executes dropped EXE 1 IoCs
pid Process 3564 svchostz.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kMRhG.vbs wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kMRhG.vbs wscript.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kMRhG = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\kMRhG.vbs\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\kMRhG = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\kMRhG.vbs\"" wscript.exe - JavaScript code in executable 1 IoCs
resource yara_rule behavioral2/files/0x000100000001ab77-6.dat js - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 18 ip-api.com - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3324 wrote to memory of 3564 3324 2f7c799eb16f3ee23dea72b7aa2ff3797b797c6060d5d23fe424b80e36ff10c8.exe 75 PID 3324 wrote to memory of 3564 3324 2f7c799eb16f3ee23dea72b7aa2ff3797b797c6060d5d23fe424b80e36ff10c8.exe 75 PID 3324 wrote to memory of 3564 3324 2f7c799eb16f3ee23dea72b7aa2ff3797b797c6060d5d23fe424b80e36ff10c8.exe 75 PID 3564 wrote to memory of 1928 3564 svchostz.exe 77 PID 3564 wrote to memory of 1928 3564 svchostz.exe 77 PID 3564 wrote to memory of 1928 3564 svchostz.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f7c799eb16f3ee23dea72b7aa2ff3797b797c6060d5d23fe424b80e36ff10c8.exe"C:\Users\Admin\AppData\Local\Temp\2f7c799eb16f3ee23dea72b7aa2ff3797b797c6060d5d23fe424b80e36ff10c8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\svchostz.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\svchostz.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Roaming\kMRhG.vbs3⤵
- Blacklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1928
-
-