Malware Analysis & Threat Intel: UAC Bypasses

This video analyzes a VBScript stager delivering Remcos RAT, demonstrating static deobfuscation and identifying a UAC bypass technique using cmstp.exe 0:00-0:4516:18-18:06.

Key Takeaways:
• The analyst simplifies a noisy 4,000-line VBScript file by removing junk code, revealing logic that stages a PowerShell payload by writing characters to a text file 1:40-3:064:24-7:00.
• Instead of executing the malware, the script is modified to echo the PowerShell command, allowing the extraction and deobfuscation of the final payload using a character-skipping algorithm 8:20-9:2512:26-12:54.
• Dynamic analysis in the ANY.RUN sandbox confirms the process chain and reveals a UAC bypass where cmstp.exe executes a malicious INF file to gain high-integrity privileges without user prompts 14:41-16:1316:18-18:06.
• The presenter utilizes ANY.RUN's new Threat Intelligence features to find other malware families, such as Agent Tesla, employing the same cmstp UAC bypass technique 19:46-32:02.

The walkthrough effectively combines static analysis, dynamic sandboxing, and threat intelligence to dissect complex malware behaviors and evasion methods 31:20-32:02.

Sources:

• 0:00 Introduction to the Remcos RAT stager
• 1:40 Cleaning VBScript junk code
• 4:24 Staging PowerShell payload
• 8:20 Extracting payload in Windows VM
• 12:26 Deobfuscating PowerShell strings
• 16:18 Identifying cmstp UAC bypass
• 19:46 ANY.RUN Threat Intelligence features