wshrat | 3d5ef68daea946a0c55fa8dbc18e430206fbc69d9b1884978b6eee60b3c5cdb6

General

Target
9af8ac4eae9047debbb42cb51a580d88.exe
Size 6.4MB
Sample220514-3dn7tscah3
SHA256 3d5ef68daea946a0c55fa8dbc18e430206fbc69d9b1884978b6eee60b3c5cdb6
MD5 9af8ac4eae9047debbb42cb51a580d88
SHA1 02fb6213a0758c509d8824e6e50aa39b92f7f6f6
SHA512 344a1b438feab1cd1c732edeccfb69186ce10fb4de4034e0bbe0d82bc96b84527a198e5fe27e55bb8da2a6cc021a15c3f1e0d37671c23a057d3493c50637af86
MD5 SHA1 SHA512

Score

10^/10

wshrat persistence suricata trojan

Malware Config

Extracted

Family

wshrat

C2

http://freehost222.ddns.net:1555

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT Payload 3 IoCs

resource	yara_rule
behavioral2/files/0x0003000000000733-136.dat	family_wshrat
behavioral2/files/0x00070000000231c4-138.dat	family_wshrat
behavioral2/files/0x00070000000231c5-139.dat	family_wshrat

suricata: ET MALWARE WSHRAT CnC Checkin
suricata: ET MALWARE WSHRAT CnC Checkin
suricata
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata

Blocklisted process makes network request 7 IoCs

flow	pid	Process
15	4128	wscript.exe
17	4128	wscript.exe
35	4128	wscript.exe
37	4128	wscript.exe
38	4128	wscript.exe
39	4128	wscript.exe
40	4128	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
3412	xEnigma32g.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	9af8ac4eae9047debbb42cb51a580d88.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xLicense.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xLicense.js	WScript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	WScript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	9af8ac4eae9047debbb42cb51a580d88.exe

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	39	WSHRAT\|E27E20AC\|TWJYXOUL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 15/5/2022\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	40	WSHRAT\|E27E20AC\|TWJYXOUL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 15/5/2022\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	17	WSHRAT\|E27E20AC\|TWJYXOUL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 15/5/2022\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	35	WSHRAT\|E27E20AC\|TWJYXOUL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 15/5/2022\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	37	WSHRAT\|E27E20AC\|TWJYXOUL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 15/5/2022\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	38	WSHRAT\|E27E20AC\|TWJYXOUL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 15/5/2022\|JavaScript-v2.0\|NL:Netherlands

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 3412	1524	9af8ac4eae9047debbb42cb51a580d88.exe	83
PID 1524 wrote to memory of 3412	1524	9af8ac4eae9047debbb42cb51a580d88.exe	83
PID 1524 wrote to memory of 3412	1524	9af8ac4eae9047debbb42cb51a580d88.exe	83
PID 1524 wrote to memory of 4756	1524	9af8ac4eae9047debbb42cb51a580d88.exe	84
PID 1524 wrote to memory of 4756	1524	9af8ac4eae9047debbb42cb51a580d88.exe	84
PID 4756 wrote to memory of 4128	4756	WScript.exe	85
PID 4756 wrote to memory of 4128	4756	WScript.exe	85

C:\Users\Admin\AppData\Local\Temp\9af8ac4eae9047debbb42cb51a580d88.exe
"C:\Users\Admin\AppData\Local\Temp\9af8ac4eae9047debbb42cb51a580d88.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe
  "C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe"
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\xLicense.js"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\xLicense.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    PID:4128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xEnigma32g.exe

Path C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe
Size 6.3MB
SHA256 fb30eadcf2ed6162142941d6282e4ef11134d3a16b711373abb9dada1235b002
MD5 165871e449aff3bcb0e39cf7844ac512
SHA1 07c578daefaa429f2c689d129ad2550e6e498900
SHA512 a126152c2cb0b147eb4f6900e276cd80e8cc661395dbcd298360952d5d7f9154cbea4344579e1b43526bbe3d768a14e2f9467eeb0dc210dee12db930c7af56f0
SSDEEP 196608:l0ZxBOf0UbWYBaKNUoibfMwva74iAI0Bw68hlfpk:l0zIDKYFJgMj74BI0Bw68k
MD5 SHA1 SHA512 SSDEEP

Submit Download

xEnigma32g.exe

Path C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe
Size 6.3MB
SHA256 fb30eadcf2ed6162142941d6282e4ef11134d3a16b711373abb9dada1235b002
MD5 165871e449aff3bcb0e39cf7844ac512
SHA1 07c578daefaa429f2c689d129ad2550e6e498900
SHA512 a126152c2cb0b147eb4f6900e276cd80e8cc661395dbcd298360952d5d7f9154cbea4344579e1b43526bbe3d768a14e2f9467eeb0dc210dee12db930c7af56f0
SSDEEP 196608:l0ZxBOf0UbWYBaKNUoibfMwva74iAI0Bw68hlfpk:l0zIDKYFJgMj74BI0Bw68k
MD5 SHA1 SHA512 SSDEEP

Submit Download

xLicense.js

Path C:\Users\Admin\AppData\Local\Temp\xLicense.js
Size 118KB
SHA256 a239dab614ef4ad6c7da27fd67564614f0bb273aa4fb10a3033e4e6ad2572787
MD5 ce9fc3f1e3d6613b95be547853e778d9
SHA1 32dcddfe783545087df170d01c001d1e8cc00de7
SHA512 19d68d65417eed27c6ac813df1751e8ccdb6e525ed0004965581d4290a5b953082809ea2b650014a3ccebbba8d620fbaa4e91cdd170ebf1d2487534238a2498c
SSDEEP 3072:BEHo/ore/o0g5I8QfnB/nRf/PRLFPAeRZ:BEHo/ore/o0g5I8Q/BvRPRLFPAeRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

xLicense.js

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xLicense.js
Size 118KB
SHA256 a239dab614ef4ad6c7da27fd67564614f0bb273aa4fb10a3033e4e6ad2572787
MD5 ce9fc3f1e3d6613b95be547853e778d9
SHA1 32dcddfe783545087df170d01c001d1e8cc00de7
SHA512 19d68d65417eed27c6ac813df1751e8ccdb6e525ed0004965581d4290a5b953082809ea2b650014a3ccebbba8d620fbaa4e91cdd170ebf1d2487534238a2498c
SSDEEP 3072:BEHo/ore/o0g5I8QfnB/nRf/PRLFPAeRZ:BEHo/ore/o0g5I8Q/BvRPRLFPAeRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

xLicense.js

Path C:\Users\Admin\AppData\Roaming\xLicense.js
Size 118KB
SHA256 a239dab614ef4ad6c7da27fd67564614f0bb273aa4fb10a3033e4e6ad2572787
MD5 ce9fc3f1e3d6613b95be547853e778d9
SHA1 32dcddfe783545087df170d01c001d1e8cc00de7
SHA512 19d68d65417eed27c6ac813df1751e8ccdb6e525ed0004965581d4290a5b953082809ea2b650014a3ccebbba8d620fbaa4e91cdd170ebf1d2487534238a2498c
SSDEEP 3072:BEHo/ore/o0g5I8QfnB/nRf/PRLFPAeRZ:BEHo/ore/o0g5I8Q/BvRPRLFPAeRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1524-130-0x00007FF91CE00000-0x00007FF91D8C1000-memory.dmp

Download

memory/1524-131-0x0000000000610000-0x0000000000C80000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads