wshrat | aada5f9643e13e05d4d09edb7e35de72310b40f132475db49895fb3ad8e02b4f

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2023, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp.exe
Size 438KB
Sample230403-ket6csfa8v
SHA256 aada5f9643e13e05d4d09edb7e35de72310b40f132475db49895fb3ad8e02b4f
MD5 f01550ec2b57c712913d8c980ebf885e
SHA1 e4c23ac8faf26983a95339b07b99347f31e1325c
SHA512 e2cb87d187e80eb010e93100f501de17f8f767cfdd4a4525d38ab8d046ab20911d6f8ab48db051565a4cbc39f9ac42c8c695146ab67b2295bcdf8670e0653937
SSDEEP 12288:/YIEk3JTumFJwxUplKgCWgLl352GEJHdtAYzJ2B8t:/YIEk3sSwxblEtHdeYd5t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wshrat persistence trojan

Malware Config

Extracted

Family

wshrat

http://snkcyp.duckdns.org:3369

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000000072f-151.dat	family_wshrat
behavioral2/files/0x000500000001db26-157.dat	family_wshrat

Blocklisted process makes network request 15 IoCs

flow	pid	Process
12	3868	wscript.exe
14	3868	wscript.exe
17	3868	wscript.exe
24	3868	wscript.exe
32	3868	wscript.exe
33	3868	wscript.exe
39	3868	wscript.exe
42	3868	wscript.exe
43	3868	wscript.exe
44	3868	wscript.exe
45	3868	wscript.exe
46	3868	wscript.exe
47	3868	wscript.exe
48	3868	wscript.exe
49	3868	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	zbxlkvq.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CcxGQ.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CcxGQ.vbs	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
2020	zbxlkvq.exe
2704	zbxlkvq.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CcxGQ = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\CcxGQ.vbs\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CcxGQ = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\CcxGQ.vbs\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2020 set thread context of 2704	2020	zbxlkvq.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
116	2704	WerFault.exe	84

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2020	zbxlkvq.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 2020	4632	tmp.exe	83
PID 4632 wrote to memory of 2020	4632	tmp.exe	83
PID 4632 wrote to memory of 2020	4632	tmp.exe	83
PID 2020 wrote to memory of 2704	2020	zbxlkvq.exe	84
PID 2020 wrote to memory of 2704	2020	zbxlkvq.exe	84
PID 2020 wrote to memory of 2704	2020	zbxlkvq.exe	84
PID 2020 wrote to memory of 2704	2020	zbxlkvq.exe	84
PID 2704 wrote to memory of 3868	2704	zbxlkvq.exe	85
PID 2704 wrote to memory of 3868	2704	zbxlkvq.exe	85
PID 2704 wrote to memory of 3868	2704	zbxlkvq.exe	85

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Users\Admin\AppData\Local\Temp\zbxlkvq.exe
  "C:\Users\Admin\AppData\Local\Temp\zbxlkvq.exe" C:\Users\Admin\AppData\Local\Temp\tvgfaoswulm.oy
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zbxlkvq.exe
    "C:\Users\Admin\AppData\Local\Temp\zbxlkvq.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\CcxGQ.vbs"
      4⤵
      Blocklisted process makes network request
      Drops startup file
      Adds Run key to start application
      PID:3868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 1176
      4⤵
      Program crash
      PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2704 -ip 2704
1⤵
PID:1028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

json[1].json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\json[1].json
Size 305B
SHA256 8e19896bf0b7b5ae91cc4adf8a16376868731b95517760f0606175bf4ad4a8da
MD5 9503e14ea14378cadd7d034029a92f19
SHA1 7a57c0c5d074229ec0368f00ae4289ee4cb4f63e
SHA512 10c35cf7aa7b09e81ec0ea15179f4917863b194057482fd5d17cadd8975f756b4b05519e433507f717814acc16dd77a595b854ca353956bbcd416e07d77bb22d
MD5 SHA1 SHA512

Submit Download

okehrl.av

Path C:\Users\Admin\AppData\Local\Temp\okehrl.av
Size 626KB
SHA256 659d2d51c39ccdecc463a4f9a4ab209a986cfde6389fb396831327c705dcfc9e
MD5 a13501d5889ac9d9cb32c90de341afe6
SHA1 24593a1e8c965da4486b5499f2882d0b19ab704d
SHA512 29f6ac431a82bde2c93600d871386549e49507dd7f99c9fa66f1513bdb9414da3c62c3f254d6d6a30dc47913bf838bedb15af5fd8f81bdaa4211b968ecc71c4d
SSDEEP 12288:f7FxvI4/fignrV45MJWAJSziHJkN/W9UgcA6ZMmusx7oh3ACGYftYKbaKJ6pW:nvICignpWAJSziHJYe9UtAGtusxxifth
MD5 SHA1 SHA512 SSDEEP

Submit Download

tvgfaoswulm.oy

Path C:\Users\Admin\AppData\Local\Temp\tvgfaoswulm.oy
Size 5KB
SHA256 42c174a8e64584e0e3941e75925d4a25e00ddcd58951a57a3ef7898534a4f993
MD5 a6d3d904cc9161f1f96bdecefdcca1c4
SHA1 8548c6adf640e7334754676f9f3fa6acec9770fb
SHA512 1dfb0672b61f7d40ec7bb26a71d2aa888e1e2d96906ab937676be2565e1d47925b6d647e7fdf4c81fca6a67549e4e11b8957cf23aa8b770ba1e4bf5f2702f423
SSDEEP 96:Farc6oY7tg/DrYuyk2XO5oSw0BaU+GI/d/BEC8bPrQssytv6LFLtNI7ypzs6:FarcRlahX1SJBD+GIV/eTsGv6ZLtNI7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

zbxlkvq.exe

Path C:\Users\Admin\AppData\Local\Temp\zbxlkvq.exe
Size 108KB
SHA256 24e385242b1b471a685e7d877a432bcac83ac09597a54a09c76aa35a222033cf
MD5 e21767386a87618088d8537eec37ab95
SHA1 0f4787a85a82123a7b7a315cb60fa7fdba3c678a
SHA512 9fbe0812bf215eacdb3476470747232c55dec53da3b9de0535ccc5c511b5bda29c3558f8ca41e8756a8dbab6e4eaa207bbd63c9cf18f710506bc4306240a8b38
SSDEEP 3072:JE8xbYnNArxGqt9X00QnYEYyD5bf7sIumXtTAYQybzKYNBSlpaEc3:JE8iN8tJVPEQIr7ralVc3
MD5 SHA1 SHA512 SSDEEP

Submit Download

zbxlkvq.exe

Path C:\Users\Admin\AppData\Local\Temp\zbxlkvq.exe
Size 108KB
SHA256 24e385242b1b471a685e7d877a432bcac83ac09597a54a09c76aa35a222033cf
MD5 e21767386a87618088d8537eec37ab95
SHA1 0f4787a85a82123a7b7a315cb60fa7fdba3c678a
SHA512 9fbe0812bf215eacdb3476470747232c55dec53da3b9de0535ccc5c511b5bda29c3558f8ca41e8756a8dbab6e4eaa207bbd63c9cf18f710506bc4306240a8b38
SSDEEP 3072:JE8xbYnNArxGqt9X00QnYEYyD5bf7sIumXtTAYQybzKYNBSlpaEc3:JE8iN8tJVPEQIr7ralVc3
MD5 SHA1 SHA512 SSDEEP

Submit Download

zbxlkvq.exe

Path C:\Users\Admin\AppData\Local\Temp\zbxlkvq.exe
Size 108KB
SHA256 24e385242b1b471a685e7d877a432bcac83ac09597a54a09c76aa35a222033cf
MD5 e21767386a87618088d8537eec37ab95
SHA1 0f4787a85a82123a7b7a315cb60fa7fdba3c678a
SHA512 9fbe0812bf215eacdb3476470747232c55dec53da3b9de0535ccc5c511b5bda29c3558f8ca41e8756a8dbab6e4eaa207bbd63c9cf18f710506bc4306240a8b38
SSDEEP 3072:JE8xbYnNArxGqt9X00QnYEYyD5bf7sIumXtTAYQybzKYNBSlpaEc3:JE8iN8tJVPEQIr7ralVc3
MD5 SHA1 SHA512 SSDEEP

Submit Download

CcxGQ.vbs

Path C:\Users\Admin\AppData\Roaming\CcxGQ.vbs
Size 180KB
SHA256 b74e920938d79ce4669f94d803d10d19c2330b458130b91b6c8f9f41720f8cfe
MD5 c30c220229f3395c538e0008155881d9
SHA1 54920b4a6da2ef1510dd619c41fabe4f9c104a04
SHA512 45e7dfa45cf74617abc7a3a6d2b6d47f5548ff4ae57da60efad1a2b445848329cf379c83935f61285187b7eb6c2902c1e9b6d7d3043f0c9735349761049837f9
SSDEEP 3072:6Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:6Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

CcxGQ.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CcxGQ.vbs
Size 180KB
SHA256 b74e920938d79ce4669f94d803d10d19c2330b458130b91b6c8f9f41720f8cfe
MD5 c30c220229f3395c538e0008155881d9
SHA1 54920b4a6da2ef1510dd619c41fabe4f9c104a04
SHA512 45e7dfa45cf74617abc7a3a6d2b6d47f5548ff4ae57da60efad1a2b445848329cf379c83935f61285187b7eb6c2902c1e9b6d7d3043f0c9735349761049837f9
SSDEEP 3072:6Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:6Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2704-143-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/2704-144-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/2704-147-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/2704-148-0x0000000001100000-0x0000000001110000-memory.dmp

Download

memory/2704-149-0x0000000001100000-0x0000000001110000-memory.dmp

Download

memory/2704-150-0x0000000001100000-0x0000000001110000-memory.dmp

Download

memory/2704-141-0x0000000000400000-0x000000000049C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads