wshrat | e0a6cbb68611c4fdcf712351c6c58681b4712314af8c45db041bd3e0eab83b5a

General

Target
e0a6cbb68611c4fdcf712351c6c58681b4712314af8c45db041bd3e0eab83b5a.exe
Size 6.6MB
Sample220512-nzqv8adch5
SHA256 e0a6cbb68611c4fdcf712351c6c58681b4712314af8c45db041bd3e0eab83b5a
MD5 480774d572be34a6c485359e9d52bf73
SHA1 f531849a3e3556e298fe74cdbfae6aeea1e8213e
SHA512 82546b6dd53df8a4c814cc79eb91086654d78026ae6e33b5d05cc616e7e623d25fd85b6f32322c2a6f42a059005de4d036a4285fae463b501f313e7404125679
MD5 SHA1 SHA512

Score

10^/10

wshrat persistence suricata trojan

Malware Config

Extracted

Family

wshrat

C2

http://freehost222.ddns.net:1555

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT Payload 3 IoCs

resource	yara_rule
behavioral2/files/0x000a000000022e20-137.dat	family_wshrat
behavioral2/files/0x0007000000022e2d-139.dat	family_wshrat
behavioral2/files/0x0006000000022e2e-140.dat	family_wshrat

suricata: ET MALWARE WSHRAT CnC Checkin
suricata: ET MALWARE WSHRAT CnC Checkin
suricata
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata

Blocklisted process makes network request 6 IoCs

flow	pid	Process
32	216	wscript.exe
34	216	wscript.exe
64	216	wscript.exe
84	216	wscript.exe
88	216	wscript.exe
91	216	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
4840	xEnigma32g.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	e0a6cbb68611c4fdcf712351c6c58681b4712314af8c45db041bd3e0eab83b5a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xLicense.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xLicense.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	WScript.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\software\microsoft\windows\currentversion\run	WScript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	e0a6cbb68611c4fdcf712351c6c58681b4712314af8c45db041bd3e0eab83b5a.exe

Script User-Agent 5 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	84	WSHRAT\|2664FCF0\|FSHLRPTB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 12/5/2022\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	88	WSHRAT\|2664FCF0\|FSHLRPTB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 12/5/2022\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	91	WSHRAT\|2664FCF0\|FSHLRPTB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 12/5/2022\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	34	WSHRAT\|2664FCF0\|FSHLRPTB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 12/5/2022\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	64	WSHRAT\|2664FCF0\|FSHLRPTB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 12/5/2022\|JavaScript-v2.0\|NL:Netherlands

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	452	e0a6cbb68611c4fdcf712351c6c58681b4712314af8c45db041bd3e0eab83b5a.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 4840	452	e0a6cbb68611c4fdcf712351c6c58681b4712314af8c45db041bd3e0eab83b5a.exe	84
PID 452 wrote to memory of 4840	452	e0a6cbb68611c4fdcf712351c6c58681b4712314af8c45db041bd3e0eab83b5a.exe	84
PID 452 wrote to memory of 4840	452	e0a6cbb68611c4fdcf712351c6c58681b4712314af8c45db041bd3e0eab83b5a.exe	84
PID 452 wrote to memory of 2748	452	e0a6cbb68611c4fdcf712351c6c58681b4712314af8c45db041bd3e0eab83b5a.exe	85
PID 452 wrote to memory of 2748	452	e0a6cbb68611c4fdcf712351c6c58681b4712314af8c45db041bd3e0eab83b5a.exe	85
PID 452 wrote to memory of 2748	452	e0a6cbb68611c4fdcf712351c6c58681b4712314af8c45db041bd3e0eab83b5a.exe	85
PID 2748 wrote to memory of 216	2748	WScript.exe	86
PID 2748 wrote to memory of 216	2748	WScript.exe	86
PID 2748 wrote to memory of 216	2748	WScript.exe	86

C:\Users\Admin\AppData\Local\Temp\e0a6cbb68611c4fdcf712351c6c58681b4712314af8c45db041bd3e0eab83b5a.exe
"C:\Users\Admin\AppData\Local\Temp\e0a6cbb68611c4fdcf712351c6c58681b4712314af8c45db041bd3e0eab83b5a.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:452
- C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe
  "C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe"
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\xLicense.js"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\xLicense.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    PID:216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xEnigma32g.exe

Path C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe
Size 6.3MB
SHA256 fb30eadcf2ed6162142941d6282e4ef11134d3a16b711373abb9dada1235b002
MD5 165871e449aff3bcb0e39cf7844ac512
SHA1 07c578daefaa429f2c689d129ad2550e6e498900
SHA512 a126152c2cb0b147eb4f6900e276cd80e8cc661395dbcd298360952d5d7f9154cbea4344579e1b43526bbe3d768a14e2f9467eeb0dc210dee12db930c7af56f0
SSDEEP 196608:l0ZxBOf0UbWYBaKNUoibfMwva74iAI0Bw68hlfpk:l0zIDKYFJgMj74BI0Bw68k
MD5 SHA1 SHA512 SSDEEP

Submit Download

xEnigma32g.exe

Path C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe
Size 6.3MB
SHA256 fb30eadcf2ed6162142941d6282e4ef11134d3a16b711373abb9dada1235b002
MD5 165871e449aff3bcb0e39cf7844ac512
SHA1 07c578daefaa429f2c689d129ad2550e6e498900
SHA512 a126152c2cb0b147eb4f6900e276cd80e8cc661395dbcd298360952d5d7f9154cbea4344579e1b43526bbe3d768a14e2f9467eeb0dc210dee12db930c7af56f0
SSDEEP 196608:l0ZxBOf0UbWYBaKNUoibfMwva74iAI0Bw68hlfpk:l0zIDKYFJgMj74BI0Bw68k
MD5 SHA1 SHA512 SSDEEP

Submit Download

xLicense.js

Path C:\Users\Admin\AppData\Local\Temp\xLicense.js
Size 118KB
SHA256 a239dab614ef4ad6c7da27fd67564614f0bb273aa4fb10a3033e4e6ad2572787
MD5 ce9fc3f1e3d6613b95be547853e778d9
SHA1 32dcddfe783545087df170d01c001d1e8cc00de7
SHA512 19d68d65417eed27c6ac813df1751e8ccdb6e525ed0004965581d4290a5b953082809ea2b650014a3ccebbba8d620fbaa4e91cdd170ebf1d2487534238a2498c
SSDEEP 3072:BEHo/ore/o0g5I8QfnB/nRf/PRLFPAeRZ:BEHo/ore/o0g5I8Q/BvRPRLFPAeRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

xLicense.js

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xLicense.js
Size 118KB
SHA256 a239dab614ef4ad6c7da27fd67564614f0bb273aa4fb10a3033e4e6ad2572787
MD5 ce9fc3f1e3d6613b95be547853e778d9
SHA1 32dcddfe783545087df170d01c001d1e8cc00de7
SHA512 19d68d65417eed27c6ac813df1751e8ccdb6e525ed0004965581d4290a5b953082809ea2b650014a3ccebbba8d620fbaa4e91cdd170ebf1d2487534238a2498c
SSDEEP 3072:BEHo/ore/o0g5I8QfnB/nRf/PRLFPAeRZ:BEHo/ore/o0g5I8Q/BvRPRLFPAeRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

xLicense.js

Path C:\Users\Admin\AppData\Roaming\xLicense.js
Size 118KB
SHA256 a239dab614ef4ad6c7da27fd67564614f0bb273aa4fb10a3033e4e6ad2572787
MD5 ce9fc3f1e3d6613b95be547853e778d9
SHA1 32dcddfe783545087df170d01c001d1e8cc00de7
SHA512 19d68d65417eed27c6ac813df1751e8ccdb6e525ed0004965581d4290a5b953082809ea2b650014a3ccebbba8d620fbaa4e91cdd170ebf1d2487534238a2498c
SSDEEP 3072:BEHo/ore/o0g5I8QfnB/nRf/PRLFPAeRZ:BEHo/ore/o0g5I8Q/BvRPRLFPAeRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/452-130-0x0000000005E30000-0x00000000063D4000-memory.dmp

Download

memory/452-131-0x00000000063E0000-0x0000000006472000-memory.dmp

Download

memory/452-132-0x0000000007400000-0x000000000740A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads