Analysis
- max time kernel
150s - max time network
180s - platform
windows7_x64 - resource
win7-20230831-en - resource tags
- submitted
11/10/2023, 06:37
General
- Target 6b262e3cfe7e64378337669bbdf768fb.exe
- Size 607KB
- Sample231011-hdlrgsfc3x
- SHA256 577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea
Malware Config
Signatures
- WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
- WSHRAT payload 1 IoCs
- Blocklisted process makes network request 7 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b262e3cfe7e64378337669bbdf768fb.exe"C:\Users\Admin\AppData\Local\Temp\6b262e3cfe7e64378337669bbdf768fb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\mGxdd.vbs"3⤵
- Blocklisted process makes network request
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
mGxdd.vbs
memory/2112-17-0x0000000000400000-0x000000000048A000-memory.dmp
memory/2112-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2112-24-0x0000000074200000-0x00000000748EE000-memory.dmp
memory/2112-20-0x0000000074200000-0x00000000748EE000-memory.dmp
memory/2112-19-0x0000000000400000-0x000000000048A000-memory.dmp
memory/2112-6-0x0000000000400000-0x000000000048A000-memory.dmp
memory/2112-8-0x0000000000400000-0x000000000048A000-memory.dmp
memory/2112-10-0x0000000000400000-0x000000000048A000-memory.dmp
memory/2112-12-0x0000000000400000-0x000000000048A000-memory.dmp
memory/2112-15-0x0000000000400000-0x000000000048A000-memory.dmp
memory/2360-2-0x0000000004D20000-0x0000000004F5E000-memory.dmp
memory/2360-0-0x0000000074200000-0x00000000748EE000-memory.dmp
memory/2360-5-0x00000000005E0000-0x00000000005F2000-memory.dmp
memory/2360-4-0x0000000004AE0000-0x0000000004D1C000-memory.dmp
memory/2360-21-0x0000000074200000-0x00000000748EE000-memory.dmp
memory/2360-1-0x0000000004AA0000-0x0000000004AE0000-memory.dmp
memory/2360-3-0x0000000004AA0000-0x0000000004AE0000-memory.dmp