wshrat | 0b8be08e9fc3281203f8eaa1e932edbc85dd7d0c119b5181013942ad9c0583ba

General

Target
0b8be08e9fc3281203f8eaa1e932edbc85dd7d0c119b5181013942ad9c0583ba.exe
Size 6.4MB
Sample220511-c1zzqsgdfj
SHA256 0b8be08e9fc3281203f8eaa1e932edbc85dd7d0c119b5181013942ad9c0583ba
MD5 5b679ac606cb3cc789c7fefc0ce73aa3
SHA1 08d086a403aa3531560336b09696763f892b054e
SHA512 5a470e2ab878379d2884dbf68d16c035849a33b07187ee93219d07f097e38b9835b9ff9f5b05943385d3f622f923b0e091e0f1f1775681dc4ba9a2469297f474
MD5 SHA1 SHA512

Score

10^/10

wshrat persistence suricata trojan

Malware Config

Extracted

Family

wshrat

C2

http://freehost222.ddns.net:1555

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT Payload 3 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023164-135.dat	family_wshrat
behavioral2/files/0x0009000000023131-138.dat	family_wshrat
behavioral2/files/0x0006000000023166-139.dat	family_wshrat

suricata: ET MALWARE WSHRAT CnC Checkin
suricata: ET MALWARE WSHRAT CnC Checkin
suricata
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata

Blocklisted process makes network request 5 IoCs

flow	pid	Process
27	3272	wscript.exe
35	3272	wscript.exe
45	3272	wscript.exe
59	3272	wscript.exe
71	3272	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
4468	xEnigma32g.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	0b8be08e9fc3281203f8eaa1e932edbc85dd7d0c119b5181013942ad9c0583ba.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xLicense.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xLicense.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	WScript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\software\microsoft\windows\currentversion\run	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
26	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	0b8be08e9fc3281203f8eaa1e932edbc85dd7d0c119b5181013942ad9c0583ba.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	45	WSHRAT\|1A04E476\|TLWHJTYB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 11/5/2022\|JavaScript-v2.0\|01:Unknown
HTTP User-Agent header	59	WSHRAT\|1A04E476\|TLWHJTYB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 11/5/2022\|JavaScript-v2.0\|01:Unknown
HTTP User-Agent header	71	WSHRAT\|1A04E476\|TLWHJTYB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 11/5/2022\|JavaScript-v2.0\|01:Unknown

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 4468	3432	0b8be08e9fc3281203f8eaa1e932edbc85dd7d0c119b5181013942ad9c0583ba.exe	81
PID 3432 wrote to memory of 4468	3432	0b8be08e9fc3281203f8eaa1e932edbc85dd7d0c119b5181013942ad9c0583ba.exe	81
PID 3432 wrote to memory of 4468	3432	0b8be08e9fc3281203f8eaa1e932edbc85dd7d0c119b5181013942ad9c0583ba.exe	81
PID 3432 wrote to memory of 4316	3432	0b8be08e9fc3281203f8eaa1e932edbc85dd7d0c119b5181013942ad9c0583ba.exe	82
PID 3432 wrote to memory of 4316	3432	0b8be08e9fc3281203f8eaa1e932edbc85dd7d0c119b5181013942ad9c0583ba.exe	82
PID 4316 wrote to memory of 3272	4316	WScript.exe	83
PID 4316 wrote to memory of 3272	4316	WScript.exe	83

C:\Users\Admin\AppData\Local\Temp\0b8be08e9fc3281203f8eaa1e932edbc85dd7d0c119b5181013942ad9c0583ba.exe
"C:\Users\Admin\AppData\Local\Temp\0b8be08e9fc3281203f8eaa1e932edbc85dd7d0c119b5181013942ad9c0583ba.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe
  "C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe"
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\xLicense.js"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\xLicense.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    PID:3272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xEnigma32g.exe

Path C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe
Size 6.3MB
SHA256 fb30eadcf2ed6162142941d6282e4ef11134d3a16b711373abb9dada1235b002
MD5 165871e449aff3bcb0e39cf7844ac512
SHA1 07c578daefaa429f2c689d129ad2550e6e498900
SHA512 a126152c2cb0b147eb4f6900e276cd80e8cc661395dbcd298360952d5d7f9154cbea4344579e1b43526bbe3d768a14e2f9467eeb0dc210dee12db930c7af56f0
SSDEEP 196608:l0ZxBOf0UbWYBaKNUoibfMwva74iAI0Bw68hlfpk:l0zIDKYFJgMj74BI0Bw68k
MD5 SHA1 SHA512 SSDEEP

Submit Download

xEnigma32g.exe

Path C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe
Size 6.3MB
SHA256 fb30eadcf2ed6162142941d6282e4ef11134d3a16b711373abb9dada1235b002
MD5 165871e449aff3bcb0e39cf7844ac512
SHA1 07c578daefaa429f2c689d129ad2550e6e498900
SHA512 a126152c2cb0b147eb4f6900e276cd80e8cc661395dbcd298360952d5d7f9154cbea4344579e1b43526bbe3d768a14e2f9467eeb0dc210dee12db930c7af56f0
SSDEEP 196608:l0ZxBOf0UbWYBaKNUoibfMwva74iAI0Bw68hlfpk:l0zIDKYFJgMj74BI0Bw68k
MD5 SHA1 SHA512 SSDEEP

Submit Download

xLicense.js

Path C:\Users\Admin\AppData\Local\Temp\xLicense.js
Size 118KB
SHA256 a239dab614ef4ad6c7da27fd67564614f0bb273aa4fb10a3033e4e6ad2572787
MD5 ce9fc3f1e3d6613b95be547853e778d9
SHA1 32dcddfe783545087df170d01c001d1e8cc00de7
SHA512 19d68d65417eed27c6ac813df1751e8ccdb6e525ed0004965581d4290a5b953082809ea2b650014a3ccebbba8d620fbaa4e91cdd170ebf1d2487534238a2498c
SSDEEP 3072:BEHo/ore/o0g5I8QfnB/nRf/PRLFPAeRZ:BEHo/ore/o0g5I8Q/BvRPRLFPAeRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

xLicense.js

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xLicense.js
Size 118KB
SHA256 a239dab614ef4ad6c7da27fd67564614f0bb273aa4fb10a3033e4e6ad2572787
MD5 ce9fc3f1e3d6613b95be547853e778d9
SHA1 32dcddfe783545087df170d01c001d1e8cc00de7
SHA512 19d68d65417eed27c6ac813df1751e8ccdb6e525ed0004965581d4290a5b953082809ea2b650014a3ccebbba8d620fbaa4e91cdd170ebf1d2487534238a2498c
SSDEEP 3072:BEHo/ore/o0g5I8QfnB/nRf/PRLFPAeRZ:BEHo/ore/o0g5I8Q/BvRPRLFPAeRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

xLicense.js

Path C:\Users\Admin\AppData\Roaming\xLicense.js
Size 118KB
SHA256 a239dab614ef4ad6c7da27fd67564614f0bb273aa4fb10a3033e4e6ad2572787
MD5 ce9fc3f1e3d6613b95be547853e778d9
SHA1 32dcddfe783545087df170d01c001d1e8cc00de7
SHA512 19d68d65417eed27c6ac813df1751e8ccdb6e525ed0004965581d4290a5b953082809ea2b650014a3ccebbba8d620fbaa4e91cdd170ebf1d2487534238a2498c
SSDEEP 3072:BEHo/ore/o0g5I8QfnB/nRf/PRLFPAeRZ:BEHo/ore/o0g5I8Q/BvRPRLFPAeRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3432-130-0x0000000000080000-0x00000000006F2000-memory.dmp

Download

memory/3432-131-0x00007FFB00080000-0x00007FFB00B41000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads