wshrat | fe7cb98f06f1cc388f492f98af7dddb68423afd87e431d2bb36a8a68cc0d1471

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06-02-2024 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94cedbf96e556f012c1eab9e9b82fb7f.exe
Size

951KB
MD5

94cedbf96e556f012c1eab9e9b82fb7f
SHA1

a2f162aac845998fda8f69f3a3874357994fe749
SHA256

fe7cb98f06f1cc388f492f98af7dddb68423afd87e431d2bb36a8a68cc0d1471
SHA512

9daf76cd62777d5c411479cf396fef1c9ec569cf6949e30eda3449daf6aa44b88efcbeb654fc86703fb7e015126d83c18743fbe0dc56c0d9a1708dee46f5934f
SSDEEP

24576:SLqbFG0dJ0rk90xHSPJGiyLrLYzfjNOBR3jRl6aGgKEDiQsr:NAHXUzbNMR17pS

Score

10^/10

wshrat persistence trojan

Malware Config

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023224-6.dat	family_wshrat

Blocklisted process makes network request 7 IoCs

flow	pid	Process
13	520	wscript.exe
15	520	wscript.exe
28	520	wscript.exe
47	520	wscript.exe
56	520	wscript.exe
66	520	wscript.exe
67	520	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	94cedbf96e556f012c1eab9e9b82fb7f.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NGYgx.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NGYgx.vbs	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NGYgx = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\NGYgx.vbs\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NGYgx = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\NGYgx.vbs\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 520	1676	94cedbf96e556f012c1eab9e9b82fb7f.exe	84
PID 1676 wrote to memory of 520	1676	94cedbf96e556f012c1eab9e9b82fb7f.exe	84

C:\Users\Admin\AppData\Local\Temp\94cedbf96e556f012c1eab9e9b82fb7f.exe
"C:\Users\Admin\AppData\Local\Temp\94cedbf96e556f012c1eab9e9b82fb7f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Roaming\NGYgx.vbs
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OO2Q27PV\json[1].json

Filesize
313B

MD5
bee55e52500f967c3d9402e05dd57f65

SHA1
d8dc65ec97c6288e1fd10b8c4f8502e5a8a5bbf6

SHA256
b90eae4b05d321efc4519963349c1775dcea8e3b0ae53b50285545380b6539c0

SHA512
b8624a934fb74760f5b231ca97e89074b227ad9fe3bb08b01a81cf35760f06b346f395cf6683df5881dc429ae77af0d0a07cfeb9c9ec127e4e917191bf8c91da

Download Submit
C:\Users\Admin\AppData\Roaming\NGYgx.vbs

Filesize
180KB

MD5
0ae1f09d92f4a783e55ea78b0c66a84e

SHA1
15b9db15e28f014360a7825bf8c955932845681d

SHA256
6285f4369da554005e93a5903a3e23b77b48c8f80e15b5b4ae3d3c8d80647bbd

SHA512
3aac6c831239d3905d19b8aca3a6aada8878f039e256f0e05cd52db47b0fd5131c06cb0b95f19425bddbe4aaa0ca3ec850d5a94e86ff2b84758eb6342b0dc600

Download Submit
memory/1676-0-0x0000000000CB0000-0x0000000000CBA000-memory.dmp

Filesize
40KB

Download
memory/1676-1-0x00007FFEF6290000-0x00007FFEF6D51000-memory.dmp

Filesize
10.8MB

Download
memory/1676-2-0x0000000002DA0000-0x0000000002DB0000-memory.dmp

Filesize
64KB

Download
memory/1676-3-0x0000000002E20000-0x0000000002EAA000-memory.dmp

Filesize
552KB

Download
memory/1676-7-0x00007FFEF6290000-0x00007FFEF6D51000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads