7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
30-07-2023 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WSHRat.3.4.1.exe
Size

3.5MB
MD5

8a470899a6ebb2299b54da55ad3897d2
SHA1

1ebafddb262fe912641e260fcf407907ca67fb74
SHA256

7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313
SHA512

dde4489c467d232c5b8e7930ff0991c33aa1477666984bf69559556229b5a76951015fe38993d7289acb5aa5e9661126ed1ac9878cf44a4fbf9b06e57e1275b4
SSDEEP

49152:SMQyNFL4gSeOzD5rbhdU7bSVziW+Gz/6Sq5ms7Otvx2mAmMm0pFZMpTBkRdFFU2:NL4B35rbhCkiStvx2GcFZM1BOU

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/2740-134-0x0000000000950000-0x0000000000CCE000-memory.dmp	vmprotect

Kills process with taskkill 1 IoCs

evasion

pid	Process
3924	taskkill.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2740	WSHRat.3.4.1.exe
2740	WSHRat.3.4.1.exe
2740	WSHRat.3.4.1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	WSHRat.3.4.1.exe
Token: SeDebugPrivilege	3924	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 3976	2740	WSHRat.3.4.1.exe	95
PID 2740 wrote to memory of 3976	2740	WSHRat.3.4.1.exe	95
PID 2740 wrote to memory of 3976	2740	WSHRat.3.4.1.exe	95
PID 3976 wrote to memory of 3924	3976	cmd.exe	97
PID 3976 wrote to memory of 3924	3976	cmd.exe	97
PID 3976 wrote to memory of 3924	3976	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\WSHRat.3.4.1.exe
"C:\Users\Admin\AppData\Local\Temp\WSHRat.3.4.1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c taskkill /F /IM WSHRat.3.4.1.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM WSHRat.3.4.1.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2740-134-0x0000000000950000-0x0000000000CCE000-memory.dmp

Filesize
3.5MB

Download
memory/2740-133-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download
memory/2740-135-0x0000000005570000-0x0000000005571000-memory.dmp

Filesize
4KB

Download
memory/2740-136-0x0000000005570000-0x0000000005571000-memory.dmp

Filesize
4KB

Download
memory/2740-137-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/2740-138-0x0000000005B50000-0x0000000005BEC000-memory.dmp

Filesize
624KB

Download
memory/2740-139-0x00000000061A0000-0x0000000006744000-memory.dmp

Filesize
5.6MB

Download
memory/2740-140-0x0000000005BF0000-0x0000000005C82000-memory.dmp

Filesize
584KB

Download
memory/2740-141-0x0000000005860000-0x000000000586A000-memory.dmp

Filesize
40KB

Download
memory/2740-142-0x0000000005E10000-0x0000000005E66000-memory.dmp

Filesize
344KB

Download
memory/2740-143-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/2740-144-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download
memory/2740-145-0x0000000005570000-0x0000000005571000-memory.dmp

Filesize
4KB

Download
memory/2740-146-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/2740-147-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/2740-148-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/2740-149-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/2740-150-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/2740-153-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/2740-155-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download