wshrat | 577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea

General

Target

577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea_JC.exe
Size

607KB
MD5

6b262e3cfe7e64378337669bbdf768fb
SHA1

6f2c63adcdda5114299344058464016be1a87c70
SHA256

577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea
SHA512

36e39838c5cd75ff3f14a8d46cfcd9e3ebe12d9c9f35e9fdb6337a3e947d51e383c6800a34a76aab7b9fafd57032110f601c85acf7d19bf381b4e58a13e8363c
SSDEEP

12288:dh1Lk70TnvjcZsqnY9LH8Vaxc07BK9GGjcCUfHP2kuGZiCKAzDN/ELq:Zk70TrcZr3ycKNubUfHDFkCK8h/1

Score

10^/10

wshrat persistence trojan

Malware Config

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023212-12.dat	family_wshrat

Blocklisted process makes network request 20 IoCs

flow	pid	Process
22	500	wscript.exe
24	500	wscript.exe
30	500	wscript.exe
33	500	wscript.exe
39	500	wscript.exe
48	500	wscript.exe
59	500	wscript.exe
60	500	wscript.exe
61	500	wscript.exe
67	500	wscript.exe
68	500	wscript.exe
72	500	wscript.exe
73	500	wscript.exe
74	500	wscript.exe
75	500	wscript.exe
76	500	wscript.exe
77	500	wscript.exe
78	500	wscript.exe
82	500	wscript.exe
84	500	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mGxdd = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\mGxdd.vbs\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mGxdd = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\mGxdd.vbs\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4680 set thread context of 1136	4680	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea_JC.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea_JC.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 1136	4680	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea_JC.exe	83
PID 4680 wrote to memory of 1136	4680	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea_JC.exe	83
PID 4680 wrote to memory of 1136	4680	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea_JC.exe	83
PID 4680 wrote to memory of 1136	4680	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea_JC.exe	83
PID 4680 wrote to memory of 1136	4680	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea_JC.exe	83
PID 4680 wrote to memory of 1136	4680	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea_JC.exe	83
PID 4680 wrote to memory of 1136	4680	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea_JC.exe	83
PID 4680 wrote to memory of 1136	4680	577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea_JC.exe	83
PID 1136 wrote to memory of 500	1136	Caspol.exe	85
PID 1136 wrote to memory of 500	1136	Caspol.exe	85
PID 1136 wrote to memory of 500	1136	Caspol.exe	85

C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea_JC.exe
"C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\mGxdd.vbs"
    3⤵
    - Blocklisted process makes network request
    - Adds Run key to start application
    PID:500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FXXN8G02\json[1].json

Filesize
323B

MD5
149c2823b7eadbfb0a82388a2ab9494f

SHA1
415fe979ce5fd0064d2557a48745a3ed1a3fbf9c

SHA256
06fa5d4e7fbfb1efdc19baa034601a894b21cf729785732853ced4bb40aca869

SHA512
f8fb6b7c93c4ab37f6e250ba8ac5c82f6e17fe52156cab81d34e91107d1da716b744bfe02ee0306497a3876d5352af789a1e66dab10e11e22065bac3050475fe

Download Submit
C:\Users\Admin\AppData\Roaming\mGxdd.vbs

Filesize
180KB

MD5
37a528b11508543c88de17f1dc8eadc4

SHA1
5be2f519aefb6ee299a3b9d845e4aa22101bf572

SHA256
7a31ecc65101516fcb5db437a545a1082b41126021dd341791f5a89d8951762e

SHA512
b11e195a91c47ae8fd082668eab1ba9f02d0eaf4a763579e9cc394e4977108865cf61e8921066499c7d2a32cdbc08d0de6eb4ccf90881fcf698b5c2f6ff11bdd

Download Submit
memory/1136-6-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1136-8-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/1136-13-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/4680-0-0x00000000051C0000-0x00000000053FE000-memory.dmp

Filesize
2.2MB

Download
memory/4680-1-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/4680-2-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download
memory/4680-3-0x0000000005400000-0x00000000059A4000-memory.dmp

Filesize
5.6MB

Download
memory/4680-4-0x0000000004F80000-0x00000000051BC000-memory.dmp

Filesize
2.2MB

Download
memory/4680-5-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download
memory/4680-9-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads