wshrat | 3d5ef68daea946a0c55fa8dbc18e430206fbc69d9b1884978b6eee60b3c5cdb6

General

Target
3d5ef68daea946a0c55fa8dbc18e430206fbc69d9b1884978b6eee60b3c5cdb6.exe
Size 6.4MB
Sample220511-c1x55sdfg4
SHA256 3d5ef68daea946a0c55fa8dbc18e430206fbc69d9b1884978b6eee60b3c5cdb6
MD5 9af8ac4eae9047debbb42cb51a580d88
SHA1 02fb6213a0758c509d8824e6e50aa39b92f7f6f6
SHA512 344a1b438feab1cd1c732edeccfb69186ce10fb4de4034e0bbe0d82bc96b84527a198e5fe27e55bb8da2a6cc021a15c3f1e0d37671c23a057d3493c50637af86
MD5 SHA1 SHA512

Score

10^/10

wshrat persistence suricata trojan

Malware Config

Extracted

Family

wshrat

C2

http://freehost222.ddns.net:1555

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT Payload 3 IoCs

resource	yara_rule
behavioral2/files/0x00060000000231c9-136.dat	family_wshrat
behavioral2/files/0x00060000000231cb-138.dat	family_wshrat
behavioral2/files/0x00060000000231cc-139.dat	family_wshrat

suricata: ET MALWARE WSHRAT CnC Checkin
suricata: ET MALWARE WSHRAT CnC Checkin
suricata
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata

Blocklisted process makes network request 6 IoCs

flow	pid	Process
14	388	wscript.exe
16	388	wscript.exe
28	388	wscript.exe
38	388	wscript.exe
45	388	wscript.exe
48	388	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
4056	xEnigma32g.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	3d5ef68daea946a0c55fa8dbc18e430206fbc69d9b1884978b6eee60b3c5cdb6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xLicense.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xLicense.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	WScript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\software\microsoft\windows\currentversion\run	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	3d5ef68daea946a0c55fa8dbc18e430206fbc69d9b1884978b6eee60b3c5cdb6.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	28	WSHRAT\|E27E20AC\|TWJYXOUL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 11/5/2022\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	38	WSHRAT\|E27E20AC\|TWJYXOUL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 11/5/2022\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	45	WSHRAT\|E27E20AC\|TWJYXOUL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 11/5/2022\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	48	WSHRAT\|E27E20AC\|TWJYXOUL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 11/5/2022\|JavaScript-v2.0\|NL:Netherlands

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 4056	1184	3d5ef68daea946a0c55fa8dbc18e430206fbc69d9b1884978b6eee60b3c5cdb6.exe	83
PID 1184 wrote to memory of 4056	1184	3d5ef68daea946a0c55fa8dbc18e430206fbc69d9b1884978b6eee60b3c5cdb6.exe	83
PID 1184 wrote to memory of 4056	1184	3d5ef68daea946a0c55fa8dbc18e430206fbc69d9b1884978b6eee60b3c5cdb6.exe	83
PID 1184 wrote to memory of 3076	1184	3d5ef68daea946a0c55fa8dbc18e430206fbc69d9b1884978b6eee60b3c5cdb6.exe	84
PID 1184 wrote to memory of 3076	1184	3d5ef68daea946a0c55fa8dbc18e430206fbc69d9b1884978b6eee60b3c5cdb6.exe	84
PID 3076 wrote to memory of 388	3076	WScript.exe	85
PID 3076 wrote to memory of 388	3076	WScript.exe	85

C:\Users\Admin\AppData\Local\Temp\3d5ef68daea946a0c55fa8dbc18e430206fbc69d9b1884978b6eee60b3c5cdb6.exe
"C:\Users\Admin\AppData\Local\Temp\3d5ef68daea946a0c55fa8dbc18e430206fbc69d9b1884978b6eee60b3c5cdb6.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe
  "C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe"
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\xLicense.js"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\xLicense.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    PID:388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xEnigma32g.exe

Path C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe
Size 6.3MB
SHA256 fb30eadcf2ed6162142941d6282e4ef11134d3a16b711373abb9dada1235b002
MD5 165871e449aff3bcb0e39cf7844ac512
SHA1 07c578daefaa429f2c689d129ad2550e6e498900
SHA512 a126152c2cb0b147eb4f6900e276cd80e8cc661395dbcd298360952d5d7f9154cbea4344579e1b43526bbe3d768a14e2f9467eeb0dc210dee12db930c7af56f0
SSDEEP 196608:l0ZxBOf0UbWYBaKNUoibfMwva74iAI0Bw68hlfpk:l0zIDKYFJgMj74BI0Bw68k
MD5 SHA1 SHA512 SSDEEP

Submit Download

xEnigma32g.exe

Path C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe
Size 6.3MB
SHA256 fb30eadcf2ed6162142941d6282e4ef11134d3a16b711373abb9dada1235b002
MD5 165871e449aff3bcb0e39cf7844ac512
SHA1 07c578daefaa429f2c689d129ad2550e6e498900
SHA512 a126152c2cb0b147eb4f6900e276cd80e8cc661395dbcd298360952d5d7f9154cbea4344579e1b43526bbe3d768a14e2f9467eeb0dc210dee12db930c7af56f0
SSDEEP 196608:l0ZxBOf0UbWYBaKNUoibfMwva74iAI0Bw68hlfpk:l0zIDKYFJgMj74BI0Bw68k
MD5 SHA1 SHA512 SSDEEP

Submit Download

xLicense.js

Path C:\Users\Admin\AppData\Local\Temp\xLicense.js
Size 118KB
SHA256 a239dab614ef4ad6c7da27fd67564614f0bb273aa4fb10a3033e4e6ad2572787
MD5 ce9fc3f1e3d6613b95be547853e778d9
SHA1 32dcddfe783545087df170d01c001d1e8cc00de7
SHA512 19d68d65417eed27c6ac813df1751e8ccdb6e525ed0004965581d4290a5b953082809ea2b650014a3ccebbba8d620fbaa4e91cdd170ebf1d2487534238a2498c
SSDEEP 3072:BEHo/ore/o0g5I8QfnB/nRf/PRLFPAeRZ:BEHo/ore/o0g5I8Q/BvRPRLFPAeRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

xLicense.js

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xLicense.js
Size 118KB
SHA256 a239dab614ef4ad6c7da27fd67564614f0bb273aa4fb10a3033e4e6ad2572787
MD5 ce9fc3f1e3d6613b95be547853e778d9
SHA1 32dcddfe783545087df170d01c001d1e8cc00de7
SHA512 19d68d65417eed27c6ac813df1751e8ccdb6e525ed0004965581d4290a5b953082809ea2b650014a3ccebbba8d620fbaa4e91cdd170ebf1d2487534238a2498c
SSDEEP 3072:BEHo/ore/o0g5I8QfnB/nRf/PRLFPAeRZ:BEHo/ore/o0g5I8Q/BvRPRLFPAeRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

xLicense.js

Path C:\Users\Admin\AppData\Roaming\xLicense.js
Size 118KB
SHA256 a239dab614ef4ad6c7da27fd67564614f0bb273aa4fb10a3033e4e6ad2572787
MD5 ce9fc3f1e3d6613b95be547853e778d9
SHA1 32dcddfe783545087df170d01c001d1e8cc00de7
SHA512 19d68d65417eed27c6ac813df1751e8ccdb6e525ed0004965581d4290a5b953082809ea2b650014a3ccebbba8d620fbaa4e91cdd170ebf1d2487534238a2498c
SSDEEP 3072:BEHo/ore/o0g5I8QfnB/nRf/PRLFPAeRZ:BEHo/ore/o0g5I8Q/BvRPRLFPAeRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1184-130-0x00000000007C0000-0x0000000000E30000-memory.dmp

Download

memory/1184-131-0x00007FF91CE10000-0x00007FF91D8D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads