Malware Analysis Report

2024-10-23 22:00

Sample ID 241017-j3a7qayhjg
Target Quote.js
SHA256 1605ba6b37eeca60319c2a18a2004856d01b7563aa660793d229a80acbfa669b
Tags
wshrat collection discovery execution persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1605ba6b37eeca60319c2a18a2004856d01b7563aa660793d229a80acbfa669b

Threat Level: Known bad

The file Quote.js was found to be: Known bad.

Malicious Activity Summary

wshrat collection discovery execution persistence spyware stealer trojan

WSHRAT

Detected Nirsoft tools

NirSoft MailPassView

Blocklisted process makes network request

Loads dropped DLL

Executes dropped EXE

Drops startup file

Checks computer location settings

Reads user/profile data of web browsers

Accesses Microsoft Outlook accounts

Adds Run key to start application

Looks up external IP address via web service

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Command and Scripting Interpreter: JavaScript

Suspicious behavior: EnumeratesProcesses

Uses Volume Shadow Copy service COM API

Uses Volume Shadow Copy WMI provider

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Script User-Agent

Modifies registry class

Kills process with taskkill

Runs .reg file with regedit

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-17 08:11

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-17 08:11

Reported

2024-10-17 08:13

Platform

win7-20240903-en

Max time kernel

147s

Max time network

146s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\Quote.js

Signatures

WSHRAT

trojan wshrat

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quote.js C:\Windows\system32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quote.js C:\Windows\System32\wscript.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Roaming\cmdc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quote = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quote.js\"" C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\VKL-GBS0LE = "\"C:\\Users\\Admin\\AppData\\Roaming\\ViottoKeylogger\\vkl.exe\"" C:\Users\Admin\AppData\Roaming\keylogger.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VKL-GBS0LE = "\"C:\\Users\\Admin\\AppData\\Roaming\\ViottoKeylogger\\vkl.exe\"" C:\Users\Admin\AppData\Roaming\keylogger.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\VKL-GBS0LE = "\"C:\\Users\\Admin\\AppData\\Roaming\\ViottoKeylogger\\vkl.exe\"" C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VKL-GBS0LE = "\"C:\\Users\\Admin\\AppData\\Roaming\\ViottoKeylogger\\vkl.exe\"" C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Quote = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quote.js\"" C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quote = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quote.js\"" C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Quote = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quote.js\"" C:\Windows\System32\wscript.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Command and Scripting Interpreter: JavaScript

execution

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\keylogger.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\cmdc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\cmdc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\regedit.exe N/A
N/A N/A C:\Windows\regedit.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|44BAD2C8|JSMURNPT|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1680 wrote to memory of 1384 N/A C:\Windows\system32\wscript.exe C:\Windows\regedit.exe
PID 1680 wrote to memory of 1384 N/A C:\Windows\system32\wscript.exe C:\Windows\regedit.exe
PID 1680 wrote to memory of 1384 N/A C:\Windows\system32\wscript.exe C:\Windows\regedit.exe
PID 1680 wrote to memory of 2728 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 1680 wrote to memory of 2728 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 1680 wrote to memory of 2728 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 2728 wrote to memory of 2752 N/A C:\Windows\System32\wscript.exe C:\Windows\regedit.exe
PID 2728 wrote to memory of 2752 N/A C:\Windows\System32\wscript.exe C:\Windows\regedit.exe
PID 2728 wrote to memory of 2752 N/A C:\Windows\System32\wscript.exe C:\Windows\regedit.exe
PID 2728 wrote to memory of 2636 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\keylogger.exe
PID 2728 wrote to memory of 2636 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\keylogger.exe
PID 2728 wrote to memory of 2636 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\keylogger.exe
PID 2728 wrote to memory of 2636 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\keylogger.exe
PID 2636 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\keylogger.exe C:\Windows\SysWOW64\WScript.exe
PID 2636 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\keylogger.exe C:\Windows\SysWOW64\WScript.exe
PID 2636 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\keylogger.exe C:\Windows\SysWOW64\WScript.exe
PID 2636 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\keylogger.exe C:\Windows\SysWOW64\WScript.exe
PID 2740 wrote to memory of 2944 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2944 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2944 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2944 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2944 wrote to memory of 3040 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe
PID 2944 wrote to memory of 3040 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe
PID 2944 wrote to memory of 3040 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe
PID 2944 wrote to memory of 3040 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe
PID 2728 wrote to memory of 1768 N/A C:\Windows\System32\wscript.exe C:\Windows\system32\cmd.exe
PID 2728 wrote to memory of 1768 N/A C:\Windows\System32\wscript.exe C:\Windows\system32\cmd.exe
PID 2728 wrote to memory of 1768 N/A C:\Windows\System32\wscript.exe C:\Windows\system32\cmd.exe
PID 1768 wrote to memory of 1928 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1768 wrote to memory of 1928 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1768 wrote to memory of 1928 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2728 wrote to memory of 1936 N/A C:\Windows\System32\wscript.exe C:\Windows\system32\cmd.exe
PID 2728 wrote to memory of 1936 N/A C:\Windows\System32\wscript.exe C:\Windows\system32\cmd.exe
PID 2728 wrote to memory of 1936 N/A C:\Windows\System32\wscript.exe C:\Windows\system32\cmd.exe
PID 1936 wrote to memory of 2312 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1936 wrote to memory of 2312 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1936 wrote to memory of 2312 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2728 wrote to memory of 1492 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\cmdc.exe
PID 2728 wrote to memory of 1492 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\cmdc.exe
PID 2728 wrote to memory of 1492 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\cmdc.exe
PID 2728 wrote to memory of 1492 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\cmdc.exe
PID 2728 wrote to memory of 2224 N/A C:\Windows\System32\wscript.exe C:\Windows\system32\cmd.exe
PID 2728 wrote to memory of 2224 N/A C:\Windows\System32\wscript.exe C:\Windows\system32\cmd.exe
PID 2728 wrote to memory of 2224 N/A C:\Windows\System32\wscript.exe C:\Windows\system32\cmd.exe
PID 2224 wrote to memory of 2296 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2224 wrote to memory of 2296 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2224 wrote to memory of 2296 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2728 wrote to memory of 528 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\cmdc.exe
PID 2728 wrote to memory of 528 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\cmdc.exe
PID 2728 wrote to memory of 528 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\cmdc.exe
PID 2728 wrote to memory of 528 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\cmdc.exe
PID 2728 wrote to memory of 1708 N/A C:\Windows\System32\wscript.exe C:\Windows\system32\cmd.exe
PID 2728 wrote to memory of 1708 N/A C:\Windows\System32\wscript.exe C:\Windows\system32\cmd.exe
PID 2728 wrote to memory of 1708 N/A C:\Windows\System32\wscript.exe C:\Windows\system32\cmd.exe
PID 2728 wrote to memory of 1600 N/A C:\Windows\System32\wscript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2728 wrote to memory of 1600 N/A C:\Windows\System32\wscript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2728 wrote to memory of 1600 N/A C:\Windows\System32\wscript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\Quote.js

C:\Windows\regedit.exe

"regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Quote.js"

C:\Windows\regedit.exe

"regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg"

C:\Users\Admin\AppData\Roaming\keylogger.exe

"C:\Users\Admin\AppData\Roaming\keylogger.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe"

C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe

C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c taskkill /F /IM cmdc.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM cmdc.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c taskkill /F /IM cmdc.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM cmdc.exe

C:\Users\Admin\AppData\Roaming\cmdc.exe

"C:\Users\Admin\AppData\Roaming\cmdc.exe" /stext C:\Users\Admin\AppData\Roaming\cmdc.exedata

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c taskkill /F /IM cmdc.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM cmdc.exe

C:\Users\Admin\AppData\Roaming\cmdc.exe

"C:\Users\Admin\AppData\Roaming\cmdc.exe" /stext C:\Users\Admin\AppData\Roaming\cmdc.exedata

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c mkdir "C:\Users\Admin\AppData\Roaming\wshlogs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command [void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime] $vault = New-Object Windows.Security.Credentials.PasswordVault $vault.RetrieveAll() | % { $_.RetrievePassword();$_ } > "C:\Users\Admin\AppData\Local\Temp\tmp.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 wshsoft.company udp
FR 195.35.49.167:80 wshsoft.company tcp
FR 195.35.49.167:443 wshsoft.company tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.178.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.187.227:80 o.pki.goog tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
FR 195.35.49.167:443 wshsoft.company tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.117.22:80 crl.microsoft.com tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
FR 195.35.49.167:443 wshsoft.company tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp

Files

memory/1384-2-0x0000000000290000-0x0000000000291000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg

MD5 0e5411d7ecba9a435afda71c6c39d8fd
SHA1 2d6812052bf7be1b5e213e1d813ae39faa07284c
SHA256 cb68d50df5817e51ec5b2f72893dc4c749bf3504519107e0a78dda84d55f09e2
SHA512 903ac6e5c8a12607af267b54bcbbedfa5542c5b4f7ea289ab7c6a32a424d5b846ae406d830cb4ad48e2b46f92c504163c0856af8c3e09685a8855f39f616ddb1

memory/1384-4-0x0000000000290000-0x0000000000291000-memory.dmp

C:\Users\Admin\AppData\Roaming\Quote.js

MD5 7d2d391002b97ff0652b9148902b6abd
SHA1 142abb8196206209738c16b1da79e9773d349ba5
SHA256 1605ba6b37eeca60319c2a18a2004856d01b7563aa660793d229a80acbfa669b
SHA512 f6c1ecba496b65b8ff7f78b22e846db8dc1adceae21fd5f2ac8c0720a81cfee3c18b106d6b7cf844a47443bbf697b3c7966b795996bbc46c84ff1ad3a687ea1a

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quote.js

MD5 9a47d68ad60c5053701fc32138e054a6
SHA1 3a16660844b6412b9d3fa0c6cb84f3d3a05e89f7
SHA256 1757f2391f436fc787fab2960807a25d1959331cdcd0ceaa182a1787618dd085
SHA512 cb935590b96c84d8dd86bea1d550e73c5e4474bb6bef3616474e301900d954445497b98b65a4bda94fd4c92929f6c4ac0eaf1b45b7a6d62732f673c19266b212

C:\Users\Admin\AppData\Roaming\keylogger.exe

MD5 7d1ec62e7af8e03924a871a1043febbe
SHA1 753b472506fafb875217090d518040bc66a330ab
SHA256 69b5981fbff2fbd191b8c786da080b3783252742fe47d00d6012ce572dc32d7d
SHA512 f4e5945183c4e150525e7b4a3bd1150efb311694e00a31bf2e15491138d27877b2cb0d2bbbe0c90abf2e88f4a4ec54da412794379c3aa130d10b4f71115b3c8f

memory/2636-20-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2636-28-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\install.vbs

MD5 f4111f61c6d6f585ad20f674592ea89f
SHA1 35a84b1a1ab37853ce54560fcc71bca91b0e3ca7
SHA256 7b74cf34df17a030bc08fc12d519bda615d38bfe322865fad474a2c2266c171c
SHA512 15c2629ff9366277e1cfed9532e01c7c254b2dad0683ac3e19be9a448ad9fe8f2b5b5e1813da7f79fa930aaa10862da02f58077488ee92c91576e37c23fe66df

memory/3040-34-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2944-33-0x00000000001F0000-0x0000000000223000-memory.dmp

memory/2944-39-0x00000000001F0000-0x0000000000223000-memory.dmp

memory/3040-40-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Roaming\log.txt

MD5 8d79f6764ead71c94f3af649e25bcbb9
SHA1 723bb7f7db126157202f5ad2722cab0da5a2a223
SHA256 4c4c439dc7c081b3edee078ee649cdb3c8f18aa44ddf73aa5dae5eb1a925a7c2
SHA512 11707c094227ccfdab90965e2baba52e5883f265aee388e44ec6f84ade394718f540c4eebf395b55dffd6dd9f5c5204c68ab0478bf9c7098d42885aaeaca7a79

C:\Users\Admin\AppData\Roaming\CMDCEX~1.ZIP

MD5 a8e496443115a63697cb350f47ae1729
SHA1 a69779b57ecc8457e85066e7a5ab742c70ea653d
SHA256 6f3cf374a1aa961be87dde5aaeb1706d95cdcadbd1a4c961363e5ff33fab168d
SHA512 0c3c5504567912cfd8cf40664463cdc518ce6810bfd05af91ffee30b13f4e115a93f6faae8e5c8aa88ee91e2c3b4404126dbdfcffb82aa2625199e432a3cea9c

C:\Users\Admin\AppData\Roaming\cmdc.exe

MD5 54e8ded7b148a13d3363ac7b33f6eb06
SHA1 63dcbe2db9cc14564eb84d5e953f2f9f5c54acd9
SHA256 400b411a9bffd687c5e74f51d43b7dc92cdb8d5ca9f674456b75a5d37587d342
SHA512 bf6d047bb55150b2369bdd7dfea9c815894af2e05e5b45f2eedf67d5d6a9569189ee495870fddf334a173a4beed62d2a08807c000d4c47339ac76b760b4ae349

C:\Users\Admin\AppData\Roaming\cmdc.cfg

MD5 70e69155b8080b5db35191ab8426d084
SHA1 383deaaee90ce71b28b0a6e22124e77aa1cccf8b
SHA256 104e0212403148a018258ef005a64ec73f0a148dbee230cb5c91dd691d03aefe
SHA512 c718c69454e4d9bcac24c918bf4c7f05ab93910b8a4701bd1dc914a9ca13dffe5f083f30881b5796d239c11be2f8b3e38a7e2ac7dcabc3d9810f59d9228bf342

memory/3040-124-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1600-140-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

memory/1600-141-0x0000000001E10000-0x0000000001E18000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-17 08:11

Reported

2024-10-17 08:13

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

148s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\Quote.js

Signatures

WSHRAT

trojan wshrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Windows\system32\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Windows\System32\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\keylogger.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quote.js C:\Windows\system32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quote.js C:\Windows\System32\wscript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\keylogger.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quote = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quote.js\"" C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quote = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quote.js\"" C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VKL-GBS0LE = "\"C:\\Users\\Admin\\AppData\\Roaming\\ViottoKeylogger\\vkl.exe\"" C:\Users\Admin\AppData\Roaming\keylogger.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VKL-GBS0LE = "\"C:\\Users\\Admin\\AppData\\Roaming\\ViottoKeylogger\\vkl.exe\"" C:\Users\Admin\AppData\Roaming\keylogger.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VKL-GBS0LE = "\"C:\\Users\\Admin\\AppData\\Roaming\\ViottoKeylogger\\vkl.exe\"" C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VKL-GBS0LE = "\"C:\\Users\\Admin\\AppData\\Roaming\\ViottoKeylogger\\vkl.exe\"" C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quote = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quote.js\"" C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quote = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quote.js\"" C:\Windows\system32\wscript.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Command and Scripting Interpreter: JavaScript

execution

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\keylogger.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings C:\Windows\System32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\keylogger.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings C:\Windows\system32\wscript.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\regedit.exe N/A
N/A N/A C:\Windows\regedit.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|D87ABD25|OFGADUSE|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2320 wrote to memory of 4204 N/A C:\Windows\system32\wscript.exe C:\Windows\regedit.exe
PID 2320 wrote to memory of 4204 N/A C:\Windows\system32\wscript.exe C:\Windows\regedit.exe
PID 2320 wrote to memory of 2852 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 2320 wrote to memory of 2852 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 2852 wrote to memory of 4208 N/A C:\Windows\System32\wscript.exe C:\Windows\regedit.exe
PID 2852 wrote to memory of 4208 N/A C:\Windows\System32\wscript.exe C:\Windows\regedit.exe
PID 2852 wrote to memory of 4748 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\keylogger.exe
PID 2852 wrote to memory of 4748 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\keylogger.exe
PID 2852 wrote to memory of 4748 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\keylogger.exe
PID 4748 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Roaming\keylogger.exe C:\Windows\SysWOW64\WScript.exe
PID 4748 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Roaming\keylogger.exe C:\Windows\SysWOW64\WScript.exe
PID 4748 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Roaming\keylogger.exe C:\Windows\SysWOW64\WScript.exe
PID 1740 wrote to memory of 1568 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 1568 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 1568 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1568 wrote to memory of 4616 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe
PID 1568 wrote to memory of 4616 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe
PID 1568 wrote to memory of 4616 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\Quote.js

C:\Windows\regedit.exe

"regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Quote.js"

C:\Windows\regedit.exe

"regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg"

C:\Users\Admin\AppData\Roaming\keylogger.exe

"C:\Users\Admin\AppData\Roaming\keylogger.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe"

C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe

C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 22.102.48.37.in-addr.arpa udp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 wshsoft.company udp
FR 195.35.49.167:80 wshsoft.company tcp
FR 195.35.49.167:443 wshsoft.company tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.178.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 167.49.35.195.in-addr.arpa udp
US 8.8.8.8:53 3.178.250.142.in-addr.arpa udp
GB 142.250.187.227:80 o.pki.goog tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
FR 195.35.49.167:443 wshsoft.company tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp

Files

C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg

MD5 0e5411d7ecba9a435afda71c6c39d8fd
SHA1 2d6812052bf7be1b5e213e1d813ae39faa07284c
SHA256 cb68d50df5817e51ec5b2f72893dc4c749bf3504519107e0a78dda84d55f09e2
SHA512 903ac6e5c8a12607af267b54bcbbedfa5542c5b4f7ea289ab7c6a32a424d5b846ae406d830cb4ad48e2b46f92c504163c0856af8c3e09685a8855f39f616ddb1

C:\Users\Admin\AppData\Roaming\Quote.js

MD5 7d2d391002b97ff0652b9148902b6abd
SHA1 142abb8196206209738c16b1da79e9773d349ba5
SHA256 1605ba6b37eeca60319c2a18a2004856d01b7563aa660793d229a80acbfa669b
SHA512 f6c1ecba496b65b8ff7f78b22e846db8dc1adceae21fd5f2ac8c0720a81cfee3c18b106d6b7cf844a47443bbf697b3c7966b795996bbc46c84ff1ad3a687ea1a

C:\Users\Admin\AppData\Roaming\keylogger.exe

MD5 7d1ec62e7af8e03924a871a1043febbe
SHA1 753b472506fafb875217090d518040bc66a330ab
SHA256 69b5981fbff2fbd191b8c786da080b3783252742fe47d00d6012ce572dc32d7d
SHA512 f4e5945183c4e150525e7b4a3bd1150efb311694e00a31bf2e15491138d27877b2cb0d2bbbe0c90abf2e88f4a4ec54da412794379c3aa130d10b4f71115b3c8f

memory/4748-20-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4748-29-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\install.vbs

MD5 f4111f61c6d6f585ad20f674592ea89f
SHA1 35a84b1a1ab37853ce54560fcc71bca91b0e3ca7
SHA256 7b74cf34df17a030bc08fc12d519bda615d38bfe322865fad474a2c2266c171c
SHA512 15c2629ff9366277e1cfed9532e01c7c254b2dad0683ac3e19be9a448ad9fe8f2b5b5e1813da7f79fa930aaa10862da02f58077488ee92c91576e37c23fe66df

memory/4616-47-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Roaming\log.txt

MD5 5cb9377d287f7e3aa21bf14c5ed025de
SHA1 b1fabeb5dd2664e327ab58f3bda7de92013938bb
SHA256 d617c268d99bdfc554ac3476d64cf811d0d40c8a63d1fc0a55cdd5ddcdfeab82
SHA512 65d30a59e8a91ac9e881db3a02d16858ced2556d1e7bb84c21b81c4a39d36bcbc69ea9a3a64780a3d1da658978acc0170bd9a2af88ee0cbff97516f014b9e41e

memory/4616-73-0x0000000000400000-0x0000000000433000-memory.dmp