wshrat | 8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca

General

Target

NEAS.NEASNEAS8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99caexeexeexe_JC.exe
Size

168KB
MD5

9ba2229027f01e7ae4fd53c291a2fc06
SHA1

381e20e13c6dbf5bd287cc616b7748c09c419c3e
SHA256

8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca
SHA512

98402fe6ed1c21d3cdde6f4fde79c2b540bc85773f00f811e545f77b740217a15baaa10ef56de22be4eb4b057a73af52267ec45043efedaf1f5e43d2d906f694
SSDEEP

3072:pDKW1LgppLRHMY0TBfJvjcTp5Xqy31QinAlSVsr:pDKW1Lgbdl0TBBvjc/jQinAk+

Score

10^/10

wshrat trojan

Malware Config

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x001b0000000155fc-46.dat	family_wshrat

Downloads MZ/PE file
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	NEAS.NEASNEAS8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99caexeexeexe_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99caexeexeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99caexeexeexe_JC.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2220
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\BIN.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\BIN.exe"
  2⤵
  PID:2840
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
    3⤵
    PID:2924
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\vVqvy.vbs"
      4⤵
      PID:1216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99caexeexeexe_JC.exe"
  2⤵
  PID:2472
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 1
    3⤵
    PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\BIN.exe

Filesize
2.1MB

MD5
066dbf69cbfa16c46a2142a257c95f1d

SHA1
0300eb287c3e29642877772c348c6b683b86a305

SHA256
a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906

SHA512
c1874bf3d3c6c56168eec1b18242af7562696e9c556ab7612b4c592b78b76286ce80a44cd55222df39f4e85e27cdf19b084dfd0a24127a73615f04545925da7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\BIN.exe

Filesize
2.1MB

MD5
066dbf69cbfa16c46a2142a257c95f1d

SHA1
0300eb287c3e29642877772c348c6b683b86a305

SHA256
a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906

SHA512
c1874bf3d3c6c56168eec1b18242af7562696e9c556ab7612b4c592b78b76286ce80a44cd55222df39f4e85e27cdf19b084dfd0a24127a73615f04545925da7a

Download Submit
C:\Users\Admin\AppData\Roaming\vVqvy.vbs

Filesize
180KB

MD5
9bcc1d31eae798a11b1d50f46b1de92c

SHA1
8bc898b80ead2433ac20eaa9936d2e40ea1db01e

SHA256
cc2ca06bf02d0ba8b9ec6874b734bf6a39f84d536f6bb2d7cc5e3d577697e45b

SHA512
b0a13f056ce07f5bf1360cb9754759c499c1560ed19c684f50774d0d6f72e0669b9e10a243185d9c31555938ae2799a09222236d960fb36f935bda266b764d6d

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\BIN.exe

Filesize
2.1MB

MD5
066dbf69cbfa16c46a2142a257c95f1d

SHA1
0300eb287c3e29642877772c348c6b683b86a305

SHA256
a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906

SHA512
c1874bf3d3c6c56168eec1b18242af7562696e9c556ab7612b4c592b78b76286ce80a44cd55222df39f4e85e27cdf19b084dfd0a24127a73615f04545925da7a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\BIN.exe

Filesize
2.1MB

MD5
066dbf69cbfa16c46a2142a257c95f1d

SHA1
0300eb287c3e29642877772c348c6b683b86a305

SHA256
a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906

SHA512
c1874bf3d3c6c56168eec1b18242af7562696e9c556ab7612b4c592b78b76286ce80a44cd55222df39f4e85e27cdf19b084dfd0a24127a73615f04545925da7a

Download Submit
memory/2220-4-0x0000000002060000-0x00000000020A0000-memory.dmp

Filesize
256KB

Download
memory/2220-6-0x0000000002060000-0x00000000020A0000-memory.dmp

Filesize
256KB

Download
memory/2220-7-0x0000000002030000-0x0000000002044000-memory.dmp

Filesize
80KB

Download
memory/2220-8-0x0000000002060000-0x00000000020A0000-memory.dmp

Filesize
256KB

Download
memory/2220-9-0x0000000002060000-0x00000000020A0000-memory.dmp

Filesize
256KB

Download
memory/2220-5-0x0000000002060000-0x00000000020A0000-memory.dmp

Filesize
256KB

Download
memory/2220-0-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/2220-3-0x0000000000320000-0x0000000000334000-memory.dmp

Filesize
80KB

Download
memory/2220-2-0x0000000002060000-0x00000000020A0000-memory.dmp

Filesize
256KB

Download
memory/2220-1-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/2220-26-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-24-0x0000000004C00000-0x0000000004C40000-memory.dmp

Filesize
256KB

Download
memory/2840-23-0x0000000004D40000-0x0000000004F3A000-memory.dmp

Filesize
2.0MB

Download
memory/2840-22-0x0000000004C00000-0x0000000004C40000-memory.dmp

Filesize
256KB

Download
memory/2840-20-0x0000000004C00000-0x0000000004C40000-memory.dmp

Filesize
256KB

Download
memory/2840-25-0x00000000024B0000-0x00000000024BA000-memory.dmp

Filesize
40KB

Download
memory/2840-21-0x0000000004F40000-0x0000000005138000-memory.dmp

Filesize
2.0MB

Download
memory/2840-27-0x0000000004C00000-0x0000000004C40000-memory.dmp

Filesize
256KB

Download
memory/2840-19-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-42-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/2924-41-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2924-39-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2924-37-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2924-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2924-43-0x00000000740C0000-0x00000000747AE000-memory.dmp

Filesize
6.9MB

Download
memory/2924-34-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2924-32-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2924-28-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2924-45-0x00000000740C0000-0x00000000747AE000-memory.dmp

Filesize
6.9MB

Download
memory/2924-30-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download

Analysis

Sharing