wshrat | 08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f

General

Target

08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f_JC.js
Size

1019KB
MD5

e8536fd0f118843f3a18ec4e10831f9e
SHA1

873a031c63b540b238aa8ff30d09c08b0f6c3811
SHA256

08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f
SHA512

a50ea7d4dd18b1f0e3614d1544736d445bbea0e44a92a6903ec86c2d06c31d05f3ce5c8cf8d5eb5de87a6ae7710327263cca845f642665cd87f13ca3e74690e5
SSDEEP

6144:MQA7NcHC1yd9hSFIpgRK8VO6CbKZk+rIavG7UjcBfd82TwXtQlTrZ889unEYpcYK:X/

Score

10^/10

wshrat trojan

Malware Config

Extracted

Family

wshrat

C2

http://harold.2waky.com:3609

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 19 IoCs

flow	pid	Process
4	2840	wscript.exe
6	2840	wscript.exe
8	2840	wscript.exe
9	2840	wscript.exe
11	2840	wscript.exe
12	2840	wscript.exe
13	2840	wscript.exe
15	2840	wscript.exe
16	2840	wscript.exe
17	2840	wscript.exe
19	2840	wscript.exe
20	2840	wscript.exe
21	2840	wscript.exe
23	2840	wscript.exe
24	2840	wscript.exe
25	2840	wscript.exe
27	2840	wscript.exe
28	2840	wscript.exe
29	2840	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f_JC.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f_JC.js	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 18 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	16	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	29	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	15	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	8	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	9	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	21	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	23	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	24	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	28	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	6	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	17	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	25	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	27	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	13	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	12	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	19	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	20	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	11	WSHRAT\|C8E3CE58\|XEBBURHY\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2840	1364	wscript.exe	29
PID 1364 wrote to memory of 2840	1364	wscript.exe	29
PID 1364 wrote to memory of 2840	1364	wscript.exe	29

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f_JC.js
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f_JC.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f_JC.js

Filesize
1019KB

MD5
e8536fd0f118843f3a18ec4e10831f9e

SHA1
873a031c63b540b238aa8ff30d09c08b0f6c3811

SHA256
08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f

SHA512
a50ea7d4dd18b1f0e3614d1544736d445bbea0e44a92a6903ec86c2d06c31d05f3ce5c8cf8d5eb5de87a6ae7710327263cca845f642665cd87f13ca3e74690e5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f_JC.js

Filesize
1019KB

MD5
c7fa124b6dd1efef9a777df4fa73ecf3

SHA1
32efeb0946bfd6646d40b3178b7d0aec06237fcc

SHA256
e2d44d1cb6f005473bb99974b9a901d48eae8e242046227fe645da5b489e2adb

SHA512
93cb633f7db05c69b652bc6914af5cfc40fa00a9732d5c88232737744aa8aa1b5fbf9530170ee19c58186991b7fdb6a6646ccaafdbf13416ade6a222ed7da3aa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f_JC.js

Filesize
1019KB

MD5
e8536fd0f118843f3a18ec4e10831f9e

SHA1
873a031c63b540b238aa8ff30d09c08b0f6c3811

SHA256
08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f

SHA512
a50ea7d4dd18b1f0e3614d1544736d445bbea0e44a92a6903ec86c2d06c31d05f3ce5c8cf8d5eb5de87a6ae7710327263cca845f642665cd87f13ca3e74690e5

Download Submit

Analysis

Sharing