Malware Analysis Report

2024-10-23 22:00

Sample ID 241017-j49fxayhrb
Target Quote.js
SHA256 1605ba6b37eeca60319c2a18a2004856d01b7563aa660793d229a80acbfa669b
Tags
wshrat discovery execution persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1605ba6b37eeca60319c2a18a2004856d01b7563aa660793d229a80acbfa669b

Threat Level: Known bad

The file Quote.js was found to be: Known bad.

Malicious Activity Summary

wshrat discovery execution persistence trojan

WSHRAT

Blocklisted process makes network request

Checks computer location settings

Executes dropped EXE

Drops startup file

Loads dropped DLL

Looks up external IP address via web service

Adds Run key to start application

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Command and Scripting Interpreter: JavaScript

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of SetWindowsHookEx

Script User-Agent

Runs .reg file with regedit

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-17 08:14

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-17 08:14

Reported

2024-10-17 08:17

Platform

win7-20240903-en

Max time kernel

149s

Max time network

150s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\Quote.js

Signatures

WSHRAT

trojan wshrat

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quote.js C:\Windows\system32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quote.js C:\Windows\System32\wscript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\keylogger.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\VKL-GBS0LE = "\"C:\\Users\\Admin\\AppData\\Roaming\\ViottoKeylogger\\vkl.exe\"" C:\Users\Admin\AppData\Roaming\keylogger.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VKL-GBS0LE = "\"C:\\Users\\Admin\\AppData\\Roaming\\ViottoKeylogger\\vkl.exe\"" C:\Users\Admin\AppData\Roaming\keylogger.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\VKL-GBS0LE = "\"C:\\Users\\Admin\\AppData\\Roaming\\ViottoKeylogger\\vkl.exe\"" C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VKL-GBS0LE = "\"C:\\Users\\Admin\\AppData\\Roaming\\ViottoKeylogger\\vkl.exe\"" C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Quote = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quote.js\"" C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quote = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quote.js\"" C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Quote = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quote.js\"" C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quote = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quote.js\"" C:\Windows\System32\wscript.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Command and Scripting Interpreter: JavaScript

execution

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\keylogger.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\regedit.exe N/A
N/A N/A C:\Windows\regedit.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|B4BE3DCB|KHBTHJFA|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2188 wrote to memory of 2784 N/A C:\Windows\system32\wscript.exe C:\Windows\regedit.exe
PID 2188 wrote to memory of 2784 N/A C:\Windows\system32\wscript.exe C:\Windows\regedit.exe
PID 2188 wrote to memory of 2784 N/A C:\Windows\system32\wscript.exe C:\Windows\regedit.exe
PID 2188 wrote to memory of 2672 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 2188 wrote to memory of 2672 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 2188 wrote to memory of 2672 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 2672 wrote to memory of 2608 N/A C:\Windows\System32\wscript.exe C:\Windows\regedit.exe
PID 2672 wrote to memory of 2608 N/A C:\Windows\System32\wscript.exe C:\Windows\regedit.exe
PID 2672 wrote to memory of 2608 N/A C:\Windows\System32\wscript.exe C:\Windows\regedit.exe
PID 2672 wrote to memory of 2604 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\keylogger.exe
PID 2672 wrote to memory of 2604 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\keylogger.exe
PID 2672 wrote to memory of 2604 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\keylogger.exe
PID 2672 wrote to memory of 2604 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\keylogger.exe
PID 2604 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Roaming\keylogger.exe C:\Windows\SysWOW64\WScript.exe
PID 2604 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Roaming\keylogger.exe C:\Windows\SysWOW64\WScript.exe
PID 2604 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Roaming\keylogger.exe C:\Windows\SysWOW64\WScript.exe
PID 2604 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Roaming\keylogger.exe C:\Windows\SysWOW64\WScript.exe
PID 3020 wrote to memory of 328 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 328 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 328 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 328 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 328 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe
PID 328 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe
PID 328 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe
PID 328 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\Quote.js

C:\Windows\regedit.exe

"regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Quote.js"

C:\Windows\regedit.exe

"regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg"

C:\Users\Admin\AppData\Roaming\keylogger.exe

"C:\Users\Admin\AppData\Roaming\keylogger.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe"

C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe

C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 wshsoft.company udp
FR 195.35.49.167:80 wshsoft.company tcp
FR 195.35.49.167:443 wshsoft.company tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.178.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.178.3:80 o.pki.goog tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.117.18:80 crl.microsoft.com tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp

Files

memory/2784-2-0x0000000000320000-0x0000000000321000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg

MD5 0e5411d7ecba9a435afda71c6c39d8fd
SHA1 2d6812052bf7be1b5e213e1d813ae39faa07284c
SHA256 cb68d50df5817e51ec5b2f72893dc4c749bf3504519107e0a78dda84d55f09e2
SHA512 903ac6e5c8a12607af267b54bcbbedfa5542c5b4f7ea289ab7c6a32a424d5b846ae406d830cb4ad48e2b46f92c504163c0856af8c3e09685a8855f39f616ddb1

memory/2784-4-0x0000000000320000-0x0000000000321000-memory.dmp

C:\Users\Admin\AppData\Roaming\Quote.js

MD5 7d2d391002b97ff0652b9148902b6abd
SHA1 142abb8196206209738c16b1da79e9773d349ba5
SHA256 1605ba6b37eeca60319c2a18a2004856d01b7563aa660793d229a80acbfa669b
SHA512 f6c1ecba496b65b8ff7f78b22e846db8dc1adceae21fd5f2ac8c0720a81cfee3c18b106d6b7cf844a47443bbf697b3c7966b795996bbc46c84ff1ad3a687ea1a

C:\Users\Admin\AppData\Roaming\keylogger.exe

MD5 7d1ec62e7af8e03924a871a1043febbe
SHA1 753b472506fafb875217090d518040bc66a330ab
SHA256 69b5981fbff2fbd191b8c786da080b3783252742fe47d00d6012ce572dc32d7d
SHA512 f4e5945183c4e150525e7b4a3bd1150efb311694e00a31bf2e15491138d27877b2cb0d2bbbe0c90abf2e88f4a4ec54da412794379c3aa130d10b4f71115b3c8f

memory/2604-24-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2604-28-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\install.vbs

MD5 f4111f61c6d6f585ad20f674592ea89f
SHA1 35a84b1a1ab37853ce54560fcc71bca91b0e3ca7
SHA256 7b74cf34df17a030bc08fc12d519bda615d38bfe322865fad474a2c2266c171c
SHA512 15c2629ff9366277e1cfed9532e01c7c254b2dad0683ac3e19be9a448ad9fe8f2b5b5e1813da7f79fa930aaa10862da02f58077488ee92c91576e37c23fe66df

memory/328-33-0x0000000000150000-0x0000000000183000-memory.dmp

memory/544-39-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Roaming\log.txt

MD5 3ab1871eb464e5e816471befd1b4e1e4
SHA1 911160fab10407ff702ed993c39a1430a2c0ccb2
SHA256 43c9d2fee5406ffaffdcb15bb32178a8ed6bb001c6aceda57a3ca9bb40193092
SHA512 edfd30411c10da064db8ae4cf2fd4e19ed0bce6c88b5b54ca8e2afc44fe379110f3848830538bba27eb7d69cb034ab7ec03bc7914c91b6897ee98e4bd01ae48b

memory/544-78-0x0000000000400000-0x0000000000433000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-17 08:14

Reported

2024-10-17 08:17

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

149s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\Quote.js

Signatures

WSHRAT

trojan wshrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Windows\system32\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Windows\System32\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\keylogger.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quote.js C:\Windows\system32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quote.js C:\Windows\System32\wscript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\keylogger.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quote = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quote.js\"" C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quote = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quote.js\"" C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quote = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quote.js\"" C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quote = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quote.js\"" C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VKL-GBS0LE = "\"C:\\Users\\Admin\\AppData\\Roaming\\ViottoKeylogger\\vkl.exe\"" C:\Users\Admin\AppData\Roaming\keylogger.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VKL-GBS0LE = "\"C:\\Users\\Admin\\AppData\\Roaming\\ViottoKeylogger\\vkl.exe\"" C:\Users\Admin\AppData\Roaming\keylogger.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VKL-GBS0LE = "\"C:\\Users\\Admin\\AppData\\Roaming\\ViottoKeylogger\\vkl.exe\"" C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VKL-GBS0LE = "\"C:\\Users\\Admin\\AppData\\Roaming\\ViottoKeylogger\\vkl.exe\"" C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Command and Scripting Interpreter: JavaScript

execution

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\keylogger.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings C:\Windows\System32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\keylogger.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\regedit.exe N/A
N/A N/A C:\Windows\regedit.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A
HTTP User-Agent header WSHRAT|24025E54|UTKBEBLO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/10/2024|JavaScript-v3.4|GB:United Kingdom N/A N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 64 wrote to memory of 3244 N/A C:\Windows\system32\wscript.exe C:\Windows\regedit.exe
PID 64 wrote to memory of 3244 N/A C:\Windows\system32\wscript.exe C:\Windows\regedit.exe
PID 64 wrote to memory of 2400 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 64 wrote to memory of 2400 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 2400 wrote to memory of 2252 N/A C:\Windows\System32\wscript.exe C:\Windows\regedit.exe
PID 2400 wrote to memory of 2252 N/A C:\Windows\System32\wscript.exe C:\Windows\regedit.exe
PID 2400 wrote to memory of 956 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\keylogger.exe
PID 2400 wrote to memory of 956 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\keylogger.exe
PID 2400 wrote to memory of 956 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\keylogger.exe
PID 956 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Roaming\keylogger.exe C:\Windows\SysWOW64\WScript.exe
PID 956 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Roaming\keylogger.exe C:\Windows\SysWOW64\WScript.exe
PID 956 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Roaming\keylogger.exe C:\Windows\SysWOW64\WScript.exe
PID 2088 wrote to memory of 4688 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2088 wrote to memory of 4688 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2088 wrote to memory of 4688 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4688 wrote to memory of 4668 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe
PID 4688 wrote to memory of 4668 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe
PID 4688 wrote to memory of 4668 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\Quote.js

C:\Windows\regedit.exe

"regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Quote.js"

C:\Windows\regedit.exe

"regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg"

C:\Users\Admin\AppData\Roaming\keylogger.exe

"C:\Users\Admin\AppData\Roaming\keylogger.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe"

C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe

C:\Users\Admin\AppData\Roaming\ViottoKeylogger\vkl.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 22.102.48.37.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 wshsoft.company udp
FR 195.35.49.167:80 wshsoft.company tcp
FR 195.35.49.167:443 wshsoft.company tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.178.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.178.3:80 o.pki.goog tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 3.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 167.49.35.195.in-addr.arpa udp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
NL 37.48.102.22:2020 37.48.102.22 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp
NL 37.48.102.22:2020 37.48.102.22 tcp

Files

C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg

MD5 0e5411d7ecba9a435afda71c6c39d8fd
SHA1 2d6812052bf7be1b5e213e1d813ae39faa07284c
SHA256 cb68d50df5817e51ec5b2f72893dc4c749bf3504519107e0a78dda84d55f09e2
SHA512 903ac6e5c8a12607af267b54bcbbedfa5542c5b4f7ea289ab7c6a32a424d5b846ae406d830cb4ad48e2b46f92c504163c0856af8c3e09685a8855f39f616ddb1

C:\Users\Admin\AppData\Roaming\Quote.js

MD5 7d2d391002b97ff0652b9148902b6abd
SHA1 142abb8196206209738c16b1da79e9773d349ba5
SHA256 1605ba6b37eeca60319c2a18a2004856d01b7563aa660793d229a80acbfa669b
SHA512 f6c1ecba496b65b8ff7f78b22e846db8dc1adceae21fd5f2ac8c0720a81cfee3c18b106d6b7cf844a47443bbf697b3c7966b795996bbc46c84ff1ad3a687ea1a

C:\Users\Admin\AppData\Roaming\keylogger.exe

MD5 7d1ec62e7af8e03924a871a1043febbe
SHA1 753b472506fafb875217090d518040bc66a330ab
SHA256 69b5981fbff2fbd191b8c786da080b3783252742fe47d00d6012ce572dc32d7d
SHA512 f4e5945183c4e150525e7b4a3bd1150efb311694e00a31bf2e15491138d27877b2cb0d2bbbe0c90abf2e88f4a4ec54da412794379c3aa130d10b4f71115b3c8f

memory/956-20-0x0000000000400000-0x0000000000433000-memory.dmp

memory/956-29-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\install.vbs

MD5 f4111f61c6d6f585ad20f674592ea89f
SHA1 35a84b1a1ab37853ce54560fcc71bca91b0e3ca7
SHA256 7b74cf34df17a030bc08fc12d519bda615d38bfe322865fad474a2c2266c171c
SHA512 15c2629ff9366277e1cfed9532e01c7c254b2dad0683ac3e19be9a448ad9fe8f2b5b5e1813da7f79fa930aaa10862da02f58077488ee92c91576e37c23fe66df

memory/4668-38-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Roaming\log.txt

MD5 e0b6eeb58fbd7d7428ab458c24865d37
SHA1 a2ae56fb6d1241072a204b8f6b0c3f5d306c240e
SHA256 a5089e715201ef2611994bab4f103bdf85eba71a5f4b0b87d6eab490859c53e8
SHA512 ceb03f9cb0bc2507efc1874283f6ca02a0fccb7371b54450adb1c3921f720bad1f4ba2ab6fe603179b094a693cd38915cac94d0bf5f7d8726aeed1611d5263c2

memory/4668-68-0x0000000000400000-0x0000000000433000-memory.dmp