wshrat | 9f11277408508861dee8aeef598cbee2af8d13b0e85c65fd5ec96cf5062e25fd

Analysis

max time kernel
205s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Remittance advice payment notification as of.exe
Size 766KB
Sample221021-qb3afscef2
SHA256 9f11277408508861dee8aeef598cbee2af8d13b0e85c65fd5ec96cf5062e25fd
MD5 74d0eabf20cd753bef0fab28cc9930cd
SHA1 131c5dce13675994a53a3f68e5d6ad5b1fbe94e8
SHA512 a52755cf9036da24e4da410eca6549490696e65b2b4f8225ea1d19ce0ea36f196611c7526621abc472d952bd606158d01123df351e07122feb7fdb8009f02bae
SSDEEP 12288:/biQ2pSTPH3IkhjygJH2nzhXJXEQe3Xy3PiAo/LDRJkOBRo:/biQ2pgPjygk/EJaaA0L3kP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wshrat persistence trojan

Malware Config

Extracted

Family

wshrat

http://0b3c.duckdns.org:1988

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001e561-143.dat	family_wshrat

Blocklisted process makes network request 11 IoCs

flow	pid	Process
23	4152	wscript.exe
25	4152	wscript.exe
27	4152	wscript.exe
29	4152	wscript.exe
31	4152	wscript.exe
32	4152	wscript.exe
33	4152	wscript.exe
36	4152	wscript.exe
42	4152	wscript.exe
45	4152	wscript.exe
46	4152	wscript.exe

Executes dropped EXE 4 IoCs

pid	Process
4380	csuwthfqa.exe
428	csuwthfqa.exe
1628	csuwthfqa.exe
4912	csuwthfqa.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	csuwthfqa.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DGayX.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DGayX.vbs	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
2216	csuwthfqa.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DGayX = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\DGayX.vbs\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DGayX = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\DGayX.vbs\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4380 set thread context of 2216	4380	csuwthfqa.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3844	4380	WerFault.exe	79
4344	2216	WerFault.exe	84

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 4380	4192	Remittance advice payment notification as of.exe	79
PID 4192 wrote to memory of 4380	4192	Remittance advice payment notification as of.exe	79
PID 4192 wrote to memory of 4380	4192	Remittance advice payment notification as of.exe	79
PID 4380 wrote to memory of 428	4380	csuwthfqa.exe	81
PID 4380 wrote to memory of 428	4380	csuwthfqa.exe	81
PID 4380 wrote to memory of 428	4380	csuwthfqa.exe	81
PID 4380 wrote to memory of 1628	4380	csuwthfqa.exe	82
PID 4380 wrote to memory of 1628	4380	csuwthfqa.exe	82
PID 4380 wrote to memory of 1628	4380	csuwthfqa.exe	82
PID 4380 wrote to memory of 4912	4380	csuwthfqa.exe	83
PID 4380 wrote to memory of 4912	4380	csuwthfqa.exe	83
PID 4380 wrote to memory of 4912	4380	csuwthfqa.exe	83
PID 4380 wrote to memory of 2216	4380	csuwthfqa.exe	84
PID 4380 wrote to memory of 2216	4380	csuwthfqa.exe	84
PID 4380 wrote to memory of 2216	4380	csuwthfqa.exe	84
PID 4380 wrote to memory of 2216	4380	csuwthfqa.exe	84
PID 2216 wrote to memory of 4152	2216	csuwthfqa.exe	88
PID 2216 wrote to memory of 4152	2216	csuwthfqa.exe	88
PID 2216 wrote to memory of 4152	2216	csuwthfqa.exe	88

C:\Users\Admin\AppData\Local\Temp\Remittance advice payment notification as of.exe
"C:\Users\Admin\AppData\Local\Temp\Remittance advice payment notification as of.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Users\Admin\AppData\Local\Temp\csuwthfqa.exe
  "C:\Users\Admin\AppData\Local\Temp\csuwthfqa.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Users\Admin\AppData\Local\Temp\csuwthfqa.exe
    "C:\Users\Admin\AppData\Local\Temp\csuwthfqa.exe"
    3⤵
    - Executes dropped EXE
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\csuwthfqa.exe
    "C:\Users\Admin\AppData\Local\Temp\csuwthfqa.exe"
    3⤵
    - Executes dropped EXE
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\csuwthfqa.exe
    "C:\Users\Admin\AppData\Local\Temp\csuwthfqa.exe"
    3⤵
    - Executes dropped EXE
    PID:4912
- - C:\Users\Admin\AppData\Local\Temp\csuwthfqa.exe
    "C:\Users\Admin\AppData\Local\Temp\csuwthfqa.exe"
    3⤵
    - Checks computer location settings
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\DGayX.vbs"
      4⤵
      Blocklisted process makes network request
      Drops startup file
      Adds Run key to start application
      PID:4152
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 964
      4⤵
      Program crash
      PID:4344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 576
    3⤵
    - Program crash
    PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4380 -ip 4380
1⤵
PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2216 -ip 2216
1⤵
PID:4444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bbinf.w

Path C:\Users\Admin\AppData\Local\Temp\bbinf.w
Size 4KB
SHA256 931870702ec86cea9e92f72501cf3f3f6df6c4b4b8474c5b47c9ba6b16235be1
MD5 eec8f88d65676aad266d4b5c6561c995
SHA1 483f8fed86a6caee04c6d71b232bb5bc652c39f4
SHA512 80d1de45dc3193f19393db3f9b7361fab2c8a7a2b752f767e34960125f16d602185d339ec07c2a6d56c80e08030296f1e791cf265a73155c137785f2910c7ebb
SSDEEP 96:jKhBk+HtIl27XQpMGfU6N65SIjXde4YEwwF5Ji9lVF+o4YbK9DMKZwgA:jKX9wr4Djkm/49bx59
MD5 SHA1 SHA512 SSDEEP

Submit Download

csuwthfqa.exe

Path C:\Users\Admin\AppData\Local\Temp\csuwthfqa.exe
Size 58KB
SHA256 627615ca5fb20b3ffdcfc964b81bc3cd5370f5080164bbfa0bd964e9fd193a66
MD5 e37ea7829d28497bbfe3727f7f57ec3d
SHA1 8a17fb078438cf4bce059d8e6289742c7d0ecb30
SHA512 1cc0b9b6aae0210752150fb70a038677ead24b208405405725f255712d6c4c695639c9074b24a21fc2ffc7e6264600fe6a53f9e0a663462a7e0af6d4eda79561
SSDEEP 1536:F1ep1tOKxVeU01JVlG9NSstFdGxveJh7LY07R9xfW:F10tOKinJlwN2yp7RjfW
MD5 SHA1 SHA512 SSDEEP

Submit Download

csuwthfqa.exe

Path C:\Users\Admin\AppData\Local\Temp\csuwthfqa.exe
Size 58KB
SHA256 627615ca5fb20b3ffdcfc964b81bc3cd5370f5080164bbfa0bd964e9fd193a66
MD5 e37ea7829d28497bbfe3727f7f57ec3d
SHA1 8a17fb078438cf4bce059d8e6289742c7d0ecb30
SHA512 1cc0b9b6aae0210752150fb70a038677ead24b208405405725f255712d6c4c695639c9074b24a21fc2ffc7e6264600fe6a53f9e0a663462a7e0af6d4eda79561
SSDEEP 1536:F1ep1tOKxVeU01JVlG9NSstFdGxveJh7LY07R9xfW:F10tOKinJlwN2yp7RjfW
MD5 SHA1 SHA512 SSDEEP

Submit Download

csuwthfqa.exe

Path C:\Users\Admin\AppData\Local\Temp\csuwthfqa.exe
Size 58KB
SHA256 627615ca5fb20b3ffdcfc964b81bc3cd5370f5080164bbfa0bd964e9fd193a66
MD5 e37ea7829d28497bbfe3727f7f57ec3d
SHA1 8a17fb078438cf4bce059d8e6289742c7d0ecb30
SHA512 1cc0b9b6aae0210752150fb70a038677ead24b208405405725f255712d6c4c695639c9074b24a21fc2ffc7e6264600fe6a53f9e0a663462a7e0af6d4eda79561
SSDEEP 1536:F1ep1tOKxVeU01JVlG9NSstFdGxveJh7LY07R9xfW:F10tOKinJlwN2yp7RjfW
MD5 SHA1 SHA512 SSDEEP

Submit Download

csuwthfqa.exe

Path C:\Users\Admin\AppData\Local\Temp\csuwthfqa.exe
Size 58KB
SHA256 627615ca5fb20b3ffdcfc964b81bc3cd5370f5080164bbfa0bd964e9fd193a66
MD5 e37ea7829d28497bbfe3727f7f57ec3d
SHA1 8a17fb078438cf4bce059d8e6289742c7d0ecb30
SHA512 1cc0b9b6aae0210752150fb70a038677ead24b208405405725f255712d6c4c695639c9074b24a21fc2ffc7e6264600fe6a53f9e0a663462a7e0af6d4eda79561
SSDEEP 1536:F1ep1tOKxVeU01JVlG9NSstFdGxveJh7LY07R9xfW:F10tOKinJlwN2yp7RjfW
MD5 SHA1 SHA512 SSDEEP

Submit Download

csuwthfqa.exe

Path C:\Users\Admin\AppData\Local\Temp\csuwthfqa.exe
Size 58KB
SHA256 627615ca5fb20b3ffdcfc964b81bc3cd5370f5080164bbfa0bd964e9fd193a66
MD5 e37ea7829d28497bbfe3727f7f57ec3d
SHA1 8a17fb078438cf4bce059d8e6289742c7d0ecb30
SHA512 1cc0b9b6aae0210752150fb70a038677ead24b208405405725f255712d6c4c695639c9074b24a21fc2ffc7e6264600fe6a53f9e0a663462a7e0af6d4eda79561
SSDEEP 1536:F1ep1tOKxVeU01JVlG9NSstFdGxveJh7LY07R9xfW:F10tOKinJlwN2yp7RjfW
MD5 SHA1 SHA512 SSDEEP

Submit Download

csuwthfqa.exe

Path C:\Users\Admin\AppData\Local\Temp\csuwthfqa.exe
Size 58KB
SHA256 627615ca5fb20b3ffdcfc964b81bc3cd5370f5080164bbfa0bd964e9fd193a66
MD5 e37ea7829d28497bbfe3727f7f57ec3d
SHA1 8a17fb078438cf4bce059d8e6289742c7d0ecb30
SHA512 1cc0b9b6aae0210752150fb70a038677ead24b208405405725f255712d6c4c695639c9074b24a21fc2ffc7e6264600fe6a53f9e0a663462a7e0af6d4eda79561
SSDEEP 1536:F1ep1tOKxVeU01JVlG9NSstFdGxveJh7LY07R9xfW:F10tOKinJlwN2yp7RjfW
MD5 SHA1 SHA512 SSDEEP

Submit Download

vjamxa.jp

Path C:\Users\Admin\AppData\Local\Temp\vjamxa.jp
Size 606KB
SHA256 1c8f1b9d1ff34d0838778957b366afd84ebb4ee84f11bff9c2f657df194324cf
MD5 bc3949148fc95155acea5712e24c2057
SHA1 033f3701b0e9d3aa1b09dff926ff956a1e9e8e64
SHA512 bfd6294ff87d3a29b258981c17fcc6994e8a0658f4ceb4ae0a348b88884b85d90695155f082bddca7a3beb4d4a38d9f25a1a0396642f4319b2164c1360775504
SSDEEP 12288:sUJIZwTA6VPtkf6kWuZLe0OGKscNwGkmdhzJxlW:smIQAIPtOVZLeQKJwGkmJxI
MD5 SHA1 SHA512 SSDEEP

Submit Download

DGayX.vbs

Path C:\Users\Admin\AppData\Roaming\DGayX.vbs
Size 180KB
SHA256 7cb32afa10f19e75b6825d8fdc2cfdb77e5c0778946d2a7ca30f48e5b86d51a1
MD5 3c2b2d8593761022586156c43ca08a45
SHA1 5359d6ae1b306ecdada646d82063667e8889e96a
SHA512 3b7e09b734df0b8e664ec16c10fa9f7256718f7ea837c22774be70643fdff4379c72ca8ca6ec071fa2ddfa164202bcd89f1cf6770fc0b4d4a797e172b31c1689
SSDEEP 3072:AAg8xSdAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:AAg8xSymshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads