wshrat | 577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea

General

Target

6b262e3cfe7e64378337669bbdf768fb.exe
Size

607KB
MD5

6b262e3cfe7e64378337669bbdf768fb
SHA1

6f2c63adcdda5114299344058464016be1a87c70
SHA256

577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea
SHA512

36e39838c5cd75ff3f14a8d46cfcd9e3ebe12d9c9f35e9fdb6337a3e947d51e383c6800a34a76aab7b9fafd57032110f601c85acf7d19bf381b4e58a13e8363c
SSDEEP

12288:dh1Lk70TnvjcZsqnY9LH8Vaxc07BK9GGjcCUfHP2kuGZiCKAzDN/ELq:Zk70TrcZr3ycKNubUfHDFkCK8h/1

Score

10^/10

wshrat persistence trojan

Malware Config

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012242-23.dat	family_wshrat

Blocklisted process makes network request 7 IoCs

flow	pid	Process
4	2252	wscript.exe
5	2252	wscript.exe
7	2252	wscript.exe
8	2252	wscript.exe
9	2252	wscript.exe
10	2252	wscript.exe
11	2252	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Windows\CurrentVersion\Run\mGxdd = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\mGxdd.vbs\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mGxdd = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\mGxdd.vbs\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2360 set thread context of 2112	2360	6b262e3cfe7e64378337669bbdf768fb.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2360	6b262e3cfe7e64378337669bbdf768fb.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2112	2360	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2360 wrote to memory of 2112	2360	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2360 wrote to memory of 2112	2360	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2360 wrote to memory of 2112	2360	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2360 wrote to memory of 2112	2360	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2360 wrote to memory of 2112	2360	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2360 wrote to memory of 2112	2360	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2360 wrote to memory of 2112	2360	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2360 wrote to memory of 2112	2360	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2112 wrote to memory of 2252	2112	Caspol.exe	29
PID 2112 wrote to memory of 2252	2112	Caspol.exe	29
PID 2112 wrote to memory of 2252	2112	Caspol.exe	29
PID 2112 wrote to memory of 2252	2112	Caspol.exe	29

C:\Users\Admin\AppData\Local\Temp\6b262e3cfe7e64378337669bbdf768fb.exe
"C:\Users\Admin\AppData\Local\Temp\6b262e3cfe7e64378337669bbdf768fb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\mGxdd.vbs"
    3⤵
    - Blocklisted process makes network request
    - Adds Run key to start application
    PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mGxdd.vbs

Filesize
180KB

MD5
37a528b11508543c88de17f1dc8eadc4

SHA1
5be2f519aefb6ee299a3b9d845e4aa22101bf572

SHA256
7a31ecc65101516fcb5db437a545a1082b41126021dd341791f5a89d8951762e

SHA512
b11e195a91c47ae8fd082668eab1ba9f02d0eaf4a763579e9cc394e4977108865cf61e8921066499c7d2a32cdbc08d0de6eb4ccf90881fcf698b5c2f6ff11bdd

Download Submit
memory/2112-17-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2112-20-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/2112-12-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2112-24-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/2112-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2112-6-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2112-8-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2112-15-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2112-19-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2112-10-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2360-5-0x00000000005E0000-0x00000000005F2000-memory.dmp

Filesize
72KB

Download
memory/2360-0-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/2360-3-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Filesize
256KB

Download
memory/2360-2-0x0000000004D20000-0x0000000004F5E000-memory.dmp

Filesize
2.2MB

Download
memory/2360-21-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/2360-1-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Filesize
256KB

Download
memory/2360-4-0x0000000004AE0000-0x0000000004D1C000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads