wshrat | 5dbf39f65d41bae9a5762be44f9f1815bb76c2caabb63d1b2be274bcba2e63c7

General

Target

Request For Quotation.js
Size

973KB
MD5

fc71c87b2465e63c5205674f9aeb730a
SHA1

2854cf5945ab636c2b78d68d1caffffedf4f0827
SHA256

5dbf39f65d41bae9a5762be44f9f1815bb76c2caabb63d1b2be274bcba2e63c7
SHA512

9edfb762447dc9dc78140a632f5aa884b96112747284fb9f3275e5b960d2585fc7418672cab464ef5cd09a9f3beb9a9efb7da19f41db6b0d082e7e4dce8ee0f7
SSDEEP

6144:QQ1Umw4NGuO/GyTSVddI5qh+7StXtwTx+PrL0Srx7mnDtEKD2uEF2oEA5iUVyFWT:Tn15/

Score

10^/10

wshrat trojan

Malware Config

Extracted

Family

wshrat

C2

http://harold.2waky.com:3609

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 18 IoCs

flow	pid	Process
21	3152	wscript.exe
23	3152	wscript.exe
49	3152	wscript.exe
61	3152	wscript.exe
74	3152	wscript.exe
76	3152	wscript.exe
77	3152	wscript.exe
78	3152	wscript.exe
79	3152	wscript.exe
80	3152	wscript.exe
81	3152	wscript.exe
82	3152	wscript.exe
83	3152	wscript.exe
84	3152	wscript.exe
85	3152	wscript.exe
86	3152	wscript.exe
89	3152	wscript.exe
91	3152	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 17 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	77	WSHRAT\|DAEBE96E\|MSXGLQPS\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 18/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	79	WSHRAT\|DAEBE96E\|MSXGLQPS\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 18/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	81	WSHRAT\|DAEBE96E\|MSXGLQPS\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 18/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	82	WSHRAT\|DAEBE96E\|MSXGLQPS\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 18/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	49	WSHRAT\|DAEBE96E\|MSXGLQPS\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 18/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	76	WSHRAT\|DAEBE96E\|MSXGLQPS\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 18/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	78	WSHRAT\|DAEBE96E\|MSXGLQPS\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 18/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	83	WSHRAT\|DAEBE96E\|MSXGLQPS\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 18/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	61	WSHRAT\|DAEBE96E\|MSXGLQPS\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 18/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	85	WSHRAT\|DAEBE96E\|MSXGLQPS\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 18/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	91	WSHRAT\|DAEBE96E\|MSXGLQPS\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 18/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	84	WSHRAT\|DAEBE96E\|MSXGLQPS\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 18/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	74	WSHRAT\|DAEBE96E\|MSXGLQPS\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 18/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	80	WSHRAT\|DAEBE96E\|MSXGLQPS\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 18/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	86	WSHRAT\|DAEBE96E\|MSXGLQPS\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 18/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	89	WSHRAT\|DAEBE96E\|MSXGLQPS\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 18/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	23	WSHRAT\|DAEBE96E\|MSXGLQPS\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 18/7/2023\|JavaScript-v3.4\|NL:Netherlands

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 3152	3756	wscript.exe	86
PID 3756 wrote to memory of 3152	3756	wscript.exe	86

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Request For Quotation.js"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Request For Quotation.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:3152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js

Filesize
128KB

MD5
767db561824bab7d3411ba766d2cda45

SHA1
32a1f0be70442f216725a8e9cb8c12a66c91cb8b

SHA256
dc5a19140b43e69aa7bee6d7464bed387e154713949e14e99bd2dadb83732419

SHA512
e2547f8c927caa40e119682e0852a4815db90717d235455670e365719d7fea9d209446b89d34f2330127cd1ebc29879010aab2488e12df2763fb5e627c3846bc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js

Filesize
973KB

MD5
fc71c87b2465e63c5205674f9aeb730a

SHA1
2854cf5945ab636c2b78d68d1caffffedf4f0827

SHA256
5dbf39f65d41bae9a5762be44f9f1815bb76c2caabb63d1b2be274bcba2e63c7

SHA512
9edfb762447dc9dc78140a632f5aa884b96112747284fb9f3275e5b960d2585fc7418672cab464ef5cd09a9f3beb9a9efb7da19f41db6b0d082e7e4dce8ee0f7

Download Submit
C:\Users\Admin\AppData\Roaming\Request For Quotation.js

Filesize
973KB

MD5
fc71c87b2465e63c5205674f9aeb730a

SHA1
2854cf5945ab636c2b78d68d1caffffedf4f0827

SHA256
5dbf39f65d41bae9a5762be44f9f1815bb76c2caabb63d1b2be274bcba2e63c7

SHA512
9edfb762447dc9dc78140a632f5aa884b96112747284fb9f3275e5b960d2585fc7418672cab464ef5cd09a9f3beb9a9efb7da19f41db6b0d082e7e4dce8ee0f7

Download Submit

Analysis

Sharing