Analysis date (UTC): 14 December 2023, 01:15Analysis environment: Windows 7 Pro, build 7601, x86

doc_order_sheet_sn8577THC_13122023_pdf_0000000.vbs

MD5:846BE25FE6DD9E8A8CEB9B07CE450E1D

SHA1:9E1D81D4FE3638C6F78C6CF9C045B19E4359EFB8

SHA256:2CEAB92F90FF80D411D1749601290D25E0F22EE2EE47FE7D3933C6377AB9EDD5

Analysis result

Threat level:Malicious activity

Tags:

opendirguloaderloadertrojanratremcosstealerkeylogger

Full analysis:Analysis doc_order_sheet_sn8577THC_13122023_pdf_0000000.vbs (MD5: 846BE25FE6DD9E8A8CEB9B07CE450E1D) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Accesses system services(Win32_Service) via WMI (SCRIPT)

wscript.exe (PID: 2464)

GULOADER has been detected (SURICATA)

wab.exe (PID: 3208)

REMCOS has been detected (SURICATA)

wab.exe (PID: 3208)

Actions looks like stealing of personal data

wab.exe (PID: 2536)
wab.exe (PID: 3684)
wab.exe (PID: 3168)
wab.exe (PID: 3208)

Steals credentials from Web Browsers

wab.exe (PID: 3168)

Uses NirSoft utilities to collect credentials

wab.exe (PID: 3168)
wab.exe (PID: 2536)

Steals credentials

wab.exe (PID: 3168)
wab.exe (PID: 2536)

SUSPICIOUS

Accesses WMI object display name (SCRIPT)

wscript.exe (PID: 2464)

Accesses system date via WMI (SCRIPT)

wscript.exe (PID: 2464)

Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

wscript.exe (PID: 2464)

Executes WMI query (SCRIPT)

wscript.exe (PID: 2464)

Reads the Internet Settings

wscript.exe (PID: 2464)
wab.exe (PID: 3208)

Base64-obfuscated command line is found

wscript.exe (PID: 2464)

Accesses antivirus product name via WMI (SCRIPT)

wscript.exe (PID: 2464)

Starts POWERSHELL.EXE for commands execution

wscript.exe (PID: 2464)

Runs shell command (SCRIPT)

wscript.exe (PID: 2464)

Powershell version downgrade attack

powershell.exe (PID: 1328)

Starts CMD.EXE for commands execution

powershell.exe (PID: 1328)

Reads browser cookies

wab.exe (PID: 3208)

Application launched itself

wab.exe (PID: 3208)

Connects to unusual port

wab.exe (PID: 3208)

Accesses Microsoft Outlook profiles

wab.exe (PID: 2536)

Writes files like Keylogger logs

wab.exe (PID: 3208)

Loads DLL from Mozilla Firefox

wab.exe (PID: 3684)

INFO

Manual execution by a user

wmpnscfg.exe (PID: 3144)

Reads the computer name

wmpnscfg.exe (PID: 3144)
wab.exe (PID: 3208)
wab.exe (PID: 2536)
wab.exe (PID: 3168)
wab.exe (PID: 3684)

Checks supported languages

wmpnscfg.exe (PID: 3144)
wab.exe (PID: 3208)
wab.exe (PID: 2536)
wab.exe (PID: 3168)
wab.exe (PID: 3684)

Checks proxy server information

wab.exe (PID: 3208)

Reads the machine GUID from the registry

wab.exe (PID: 3208)
wab.exe (PID: 3684)
wab.exe (PID: 3168)

Creates files or folders in the user directory

wab.exe (PID: 3208)

Reads Environment values

wab.exe (PID: 3208)

Reads product name

wab.exe (PID: 3208)

Create files in a temporary directory

wab.exe (PID: 2536)
wab.exe (PID: 3168)
wab.exe (PID: 3684)

Threats

PID	Process	Class	Message
3208	wab.exe	Malware Command and Control Activity Detected	ET MALWARE Remcos 3.x Unencrypted Server Response
3208	wab.exe	Malware Command and Control Activity Detected	ET MALWARE Remcos 3.x Unencrypted Server Response
3208	wab.exe	Malware Command and Control Activity Detected	ET MALWARE Remcos 3.x Unencrypted Server Response