wshrat | 4e34a8f135f78c1282dcb5df97cf3ec54fb98f34b164fec6a245b49758721f47

General

Target
Statement.js
Size 184KB
Sample220621-rynagsecbm
SHA256 d924fd57be5888f8ec14872417438b3b7286d3b8e8ecd1b3688da326f6e28220
MD5 3c546d102e70da9f0a9465767ad7be62
SHA1 a48f713ec80e7c8339d04bc0853fb9f63c0679d3
SHA512 e0de055d2f4008fde65869462ba1f7180bf1356da607accac7f1808e0a60b26a2c074102390affc932848c6b36ea481cd57348cead5d3f137f797028b63d0814
MD5 SHA1 SHA512

Score

10^/10

wshrat persistence suricata trojan

Malware Config

Extracted

Family

wshrat

C2

http://newmoey2022.duckdns.org:5000

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000000072b-131.dat	family_wshrat
behavioral2/files/0x000300000000072d-132.dat	family_wshrat

suricata: ET MALWARE WSHRAT CnC Checkin
suricata: ET MALWARE WSHRAT CnC Checkin
suricata
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata

Blocklisted process makes network request 12 IoCs

flow	pid	Process
11	4832	wscript.exe
14	4832	wscript.exe
23	4832	wscript.exe
29	4832	wscript.exe
32	4832	wscript.exe
36	4832	wscript.exe
39	4832	wscript.exe
43	4832	wscript.exe
44	4832	wscript.exe
49	4832	wscript.exe
50	4832	wscript.exe
51	4832	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Statement.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Statement.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Statement = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Statement.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Statement = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Statement.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Statement = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Statement.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Statement = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Statement.js\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 7 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	14	WSHRAT\|E27E20AC\|TWJYXOUL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	29	WSHRAT\|E27E20AC\|TWJYXOUL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	43	WSHRAT\|E27E20AC\|TWJYXOUL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	44	WSHRAT\|E27E20AC\|TWJYXOUL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	49	WSHRAT\|E27E20AC\|TWJYXOUL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	50	WSHRAT\|E27E20AC\|TWJYXOUL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	51	WSHRAT\|E27E20AC\|TWJYXOUL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript-v3.4\|IE:Ireland

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 4832	1600	wscript.exe	81
PID 1600 wrote to memory of 4832	1600	wscript.exe	81

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Statement.js
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Statement.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:4832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Statement.js

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Statement.js
Size 184KB
SHA256 d924fd57be5888f8ec14872417438b3b7286d3b8e8ecd1b3688da326f6e28220
MD5 3c546d102e70da9f0a9465767ad7be62
SHA1 a48f713ec80e7c8339d04bc0853fb9f63c0679d3
SHA512 e0de055d2f4008fde65869462ba1f7180bf1356da607accac7f1808e0a60b26a2c074102390affc932848c6b36ea481cd57348cead5d3f137f797028b63d0814
SSDEEP 3072:7p8xbeXigeXzd1LHLLdV60Q0bampZevEzRbURCBeGK/6bbIpklgVDSxGfmuZmUu:7p8xbeXigeXzd1LH3dV6zMovRCBeGKWd
MD5 SHA1 SHA512 SSDEEP

Submit Download