wshrat | 577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea

General

Target

6b262e3cfe7e64378337669bbdf768fb.exe
Size

607KB
MD5

6b262e3cfe7e64378337669bbdf768fb
SHA1

6f2c63adcdda5114299344058464016be1a87c70
SHA256

577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea
SHA512

36e39838c5cd75ff3f14a8d46cfcd9e3ebe12d9c9f35e9fdb6337a3e947d51e383c6800a34a76aab7b9fafd57032110f601c85acf7d19bf381b4e58a13e8363c
SSDEEP

12288:dh1Lk70TnvjcZsqnY9LH8Vaxc07BK9GGjcCUfHP2kuGZiCKAzDN/ELq:Zk70TrcZr3ycKNubUfHDFkCK8h/1

Score

10^/10

wshrat persistence trojan

Malware Config

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023117-14.dat	family_wshrat

Blocklisted process makes network request 20 IoCs

flow	pid	Process
26	4948	wscript.exe
28	4948	wscript.exe
45	4948	wscript.exe
58	4948	wscript.exe
60	4948	wscript.exe
71	4948	wscript.exe
75	4948	wscript.exe
76	4948	wscript.exe
77	4948	wscript.exe
78	4948	wscript.exe
79	4948	wscript.exe
80	4948	wscript.exe
81	4948	wscript.exe
82	4948	wscript.exe
83	4948	wscript.exe
84	4948	wscript.exe
85	4948	wscript.exe
86	4948	wscript.exe
87	4948	wscript.exe
92	4948	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mGxdd = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\mGxdd.vbs\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mGxdd = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\mGxdd.vbs\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2712 set thread context of 1836	2712	6b262e3cfe7e64378337669bbdf768fb.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	6b262e3cfe7e64378337669bbdf768fb.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 1836	2712	6b262e3cfe7e64378337669bbdf768fb.exe	83
PID 2712 wrote to memory of 1836	2712	6b262e3cfe7e64378337669bbdf768fb.exe	83
PID 2712 wrote to memory of 1836	2712	6b262e3cfe7e64378337669bbdf768fb.exe	83
PID 2712 wrote to memory of 1836	2712	6b262e3cfe7e64378337669bbdf768fb.exe	83
PID 2712 wrote to memory of 1836	2712	6b262e3cfe7e64378337669bbdf768fb.exe	83
PID 2712 wrote to memory of 1836	2712	6b262e3cfe7e64378337669bbdf768fb.exe	83
PID 2712 wrote to memory of 1836	2712	6b262e3cfe7e64378337669bbdf768fb.exe	83
PID 2712 wrote to memory of 1836	2712	6b262e3cfe7e64378337669bbdf768fb.exe	83
PID 1836 wrote to memory of 4948	1836	Caspol.exe	87
PID 1836 wrote to memory of 4948	1836	Caspol.exe	87
PID 1836 wrote to memory of 4948	1836	Caspol.exe	87

C:\Users\Admin\AppData\Local\Temp\6b262e3cfe7e64378337669bbdf768fb.exe
"C:\Users\Admin\AppData\Local\Temp\6b262e3cfe7e64378337669bbdf768fb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\mGxdd.vbs"
    3⤵
    - Blocklisted process makes network request
    - Adds Run key to start application
    PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QHTO49S3\json[1].json

Filesize
323B

MD5
0c17abb0ed055fecf0c48bb6e46eb4eb

SHA1
a692730c8ec7353c31b94a888f359edb54aaa4c8

SHA256
f41e99f954e33e7b0e39930ec8620bf29801efc44275c1ee6b5cfa5e1be202c0

SHA512
645a9f2f94461d8a187261b736949df398ece5cfbf1af8653d18d3487ec1269d9f565534c1e249c12f31b3b1a41a8512953b1e991b001fc1360059e3fd494ec3

Download Submit
C:\Users\Admin\AppData\Roaming\mGxdd.vbs

Filesize
180KB

MD5
37a528b11508543c88de17f1dc8eadc4

SHA1
5be2f519aefb6ee299a3b9d845e4aa22101bf572

SHA256
7a31ecc65101516fcb5db437a545a1082b41126021dd341791f5a89d8951762e

SHA512
b11e195a91c47ae8fd082668eab1ba9f02d0eaf4a763579e9cc394e4977108865cf61e8921066499c7d2a32cdbc08d0de6eb4ccf90881fcf698b5c2f6ff11bdd

Download Submit
memory/1836-7-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1836-13-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/1836-10-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/2712-6-0x00000000027C0000-0x00000000027D2000-memory.dmp

Filesize
72KB

Download
memory/2712-0-0x0000000005120000-0x000000000535E000-memory.dmp

Filesize
2.2MB

Download
memory/2712-5-0x0000000004ED0000-0x000000000510C000-memory.dmp

Filesize
2.2MB

Download
memory/2712-4-0x0000000005360000-0x0000000005904000-memory.dmp

Filesize
5.6MB

Download
memory/2712-9-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/2712-3-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/2712-2-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/2712-1-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads