wshrat | ef75121bade3a31c981d6086a09633a2965380f954e6496c491e21d27c7dabc1

General

Target

37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657.js
Size

983KB
MD5

bcf2d9bfddeec58c7adfb7b85a6b179e
SHA1

bf7c734f61cf2138932782a4a7c4873084168082
SHA256

37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657
SHA512

34d3819a269e254df91355df35d871b76577f0067275f2aac18c34a76913c08b7fe1b4a434e8b444e13253a4dbed4984dfe40a85803e218fd5d4c0866072be0b
SSDEEP

6144:QQa4dEoQA8gY1J3H2gzGs/f99tz/NpjQiVAOB199LWqm0amhAuP+jLCHw7oIncrX:TVk

Score

10^/10

wshrat trojan

Malware Config

Extracted

Family

wshrat

C2

http://harold.2waky.com:1604

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 21 IoCs

flow	pid	Process
4	768	wscript.exe
6	768	wscript.exe
7	768	wscript.exe
8	768	wscript.exe
11	768	wscript.exe
12	768	wscript.exe
13	768	wscript.exe
15	768	wscript.exe
16	768	wscript.exe
17	768	wscript.exe
19	768	wscript.exe
20	768	wscript.exe
21	768	wscript.exe
23	768	wscript.exe
24	768	wscript.exe
25	768	wscript.exe
27	768	wscript.exe
28	768	wscript.exe
29	768	wscript.exe
31	768	wscript.exe
32	768	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657.js	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 19 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	11	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	13	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	17	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	6	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	15	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	16	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	27	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	29	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	31	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	19	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	20	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	21	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	8	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	12	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	23	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	24	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	25	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	28	WSHRAT\|C0585B3B\|MLXLFKOI\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 768	1472	wscript.exe	29
PID 1472 wrote to memory of 768	1472	wscript.exe	29
PID 1472 wrote to memory of 768	1472	wscript.exe	29

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657.js
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657.js

Filesize
983KB

MD5
bcf2d9bfddeec58c7adfb7b85a6b179e

SHA1
bf7c734f61cf2138932782a4a7c4873084168082

SHA256
37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657

SHA512
34d3819a269e254df91355df35d871b76577f0067275f2aac18c34a76913c08b7fe1b4a434e8b444e13253a4dbed4984dfe40a85803e218fd5d4c0866072be0b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657.js

Filesize
983KB

MD5
7eacd6a365aca31e3e50d3b5161ea70f

SHA1
3209d18f2338e5ff2d780b5152e34ce2a90b13c0

SHA256
f69b37167f6ae702a8ae993814c8ba36d624061001ecb6ce3bdb22b25842d77f

SHA512
8cf2cf0db39f48fdce389180ed42cf049ed3b7d2aa8069fe0046e9b3ebf0deeab0fabe7e0c7b1b339626c35dbcbaf7b7d087fafb74b2da72637cf3f472c96911

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657.js

Filesize
983KB

MD5
bcf2d9bfddeec58c7adfb7b85a6b179e

SHA1
bf7c734f61cf2138932782a4a7c4873084168082

SHA256
37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657

SHA512
34d3819a269e254df91355df35d871b76577f0067275f2aac18c34a76913c08b7fe1b4a434e8b444e13253a4dbed4984dfe40a85803e218fd5d4c0866072be0b

Download Submit

Analysis

Sharing