VBScript Loader Deploying Attacker-Controlled UEM Software

This advisory details a malicious VBScript-based attack chain that abuses legitimate UEM Software components to establish attacker-controlled remote-management capabilities.

Contents

Disclaimer

Overview

Attack Chain

V7 Loader Analysis

V9 Loader Analysis

What Can the Attacker Achieve?

IOCs

Actionable Recommendations

Generalize Threat Hunting Queries

Disclaimer

This educational advisory describes a threat scenario involving the malicious use and repurposing of legitimate UEM/RMM software components observed during security analysis. The findings are intended to help security teams understand attacker behavior, detection opportunities, and potential abuse of trusted management tools.

This advisory does not identify or imply any vulnerability, security flaw, or product-level weakness in any UEM/RMM OEM. The observed activity relates to the unauthorized use, configuration, and deployment of legitimate software by a threat actor and should not be interpreted as a defect in the underlying product. The content is provided solely for defensive awareness, threat hunting, detection engineering, and educational purposes.

Overview

During our recent threat-hunting and incident analysis across multiple client environments, a suspicious VBScript loader named variants of E-statement/statement of account.vbs was identified on systems used by finance personnel. The same loader was not necessarily accompanied by the complete payload on every system, which is important because the loader is designed to download its next stage rather than carrying the complete payload inside the script. This is a download-and-install chain disguised as a legitimate enterprise-management software installation.

The initial .vbs file acts as a loader. When executed, it waits for a short randomized period, creates a temporary working directory under C:\Users\Public\Documents\, contacts attacker-controlled infrastructure over HTTPS, downloads a ZIP archive, extracts the archive, locates setup1.vbs, and silently launches it.

Further analysis of the downloaded package revealed components associated with ManageEngine Endpoint Central, including UEMSAgent.msi, UEMSAgent.mst, DCAgentServerInfo.json, and Endpoint Central certificate files. While these components are legitimate software, the surrounding configuration and execution chain indicated that they had been repurposed for malicious purposes. In particular, the package contained attacker-controlled Endpoint Central server configuration, suggesting that the legitimate remote-management agent was being deployed to provide the threat actor with remote-management capabilities.

The supplied package also contains RemCom.exe, a known remote-execution utility. The combination of a remote-management agent, attacker-controlled Endpoint Central configuration, RemCom.exe, silent installation, administrative elevation, PowerShell, and cleanup creates a substantially more serious picture than a simple downloader.

The VBS script launched PowerShell, extracted a package into a Cache_* directory, launched setup1.vbs, modified power settings, executed msiexec.exe against UEMSAgent.msi, and generated network traffic to external infrastructure. It was also identified UEMSAgent.msi as a ManageEngine Desktop Central/Endpoint Central component and RemCom.exe as a remote-execution tool.

Attack Chain:

During our analysis, we observed two different versions of the file, identified as V7 and V9, as shown in the screenshot below(Due to the size of the script, the complete code is not included in this advisory. The screenshot below presents a representative portion of the script from the V7 and V9 variants for reference.). While the core functionality of both versions remains largely the same, V9 appears to be a more refined, durable, and efficient iteration of the earlier V7 version.

V7 Loader:

V9 Loader:

V7 Loader Analysis

V7 Architecture

The V7 script describes itself as a “Universal Loader” and uses a single-stage architecture:

The loader is deliberately resilient. It does not rely on one downloader or one extraction mechanism. Instead, it attempts several Windows-native technologies so that the campaign can continue operating across different Windows versions and network configurations.

The script explicitly preserves a fallback chain involving WinHTTP, ServerXMLHTTP, XMLHTTP, curl and PowerShell.

Initial Execution

The script begins with:

On Error Resume Next
Randomize

On Error Resume Next suppresses many runtime errors. From an attacker’s perspective, this makes the loader more tolerant of environmental differences. Failed COM object creation, registry access, network requests or file operations may simply be ignored and the script can attempt another method.

The script also introduces a randomized delay of approximately 2–5 seconds before beginning its primary activity.

It is an attempt to make execution slightly less deterministic and to mimic the installation timing of ordinary software.

Obfuscated COM Object Creation

V7 constructs COM object names using XOR operations.

For example:

Scripting.FileSystemObject

The script constructs the string using multiple Chr() and XOR operations.

Likewise, another encoded object resolves to:

Shell.Application

The purpose is not encryption. It is lightweight string obfuscation intended to make static scanning and simple string-based detection more difficult.

Working Directory

V7 creates a randomly named directory under:

C:\Users\Public\Documents\

The supplied V7 sample ultimately resolves this to a structure like:

C:\Users\Public\Documents\Cache_<random> \ ext\pkg_<random>.zip

V7 Download Mechanism

One of the strongest characteristics of V7 is its download resilience.

The loader can attempt several different mechanisms:

The exact order changes depending on whether the script believes the host is behind a proxy.

The script reads:

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable

and:

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL

If proxy configuration is detected, it prioritizes XMLHTTP; otherwise it generally starts with WinHTTP.

This is a notable characteristic because the loader is designed to work in enterprise environments where direct Internet connectivity may not be available.

ZIP Validation

V7 does not simply accept whatever comes back from the server.

After downloading the file, it checks that:

file size > 1024 bytes

and verifies that the first four bytes correspond to a ZIP header:

50 4B 03 04

If validation fails, the downloaded file is deleted.

This reduces the possibility that an HTML error page or proxy response is mistakenly treated as the payload.

Download Retry Logic

V7 attempts one URL and multiple retries.

The supplied V7 version contains a primary URL pointing to:

https://jb[.]CJIAN616[.]TOP/sys/D/1/c2b8[.]zip

It also appends a randomized cache-busting value:

?v=<random number>

The script uses multiple attempts with randomized delays between them.

This is a strong indication that reliability was a deliberate design goal. it has been engineered to survive network failures.

V7 Extraction and Payload Discovery

Once the ZIP has been downloaded, the loader extracts it into:

C:\Users\Public\Documents\Cache_<random>\ext\

The extraction design uses fallback methods.

Conceptually:

V7 also waits for the expected payload rather than assuming that extraction completes instantly.

The expected payload is:

setup1.vbs

If that exact file is not found, the loader searches for a unique .vbs file.

V7 Payload: setup1.vbs

The V7 setup1.vbs is considerably more important than the loader itself. Its job is to install the Endpoint Central components.

The script first determines its own directory and constructs paths to:

• UEMSAgent.msi
• UEMSAgent.mst
• DMRootCA-Server.crt
• DMRootCA.crt

It then verifies that UEMSAgent.msi exists.

The next stage is UAC elevation.

V7 uses:

ShellExecute(…, “runas”, …)

requesting administrative execution.

This means the user can receive a legitimate-looking Windows elevation prompt associated with the installation.

V7 Power Configuration Changes

After elevation, V7 executes:

powercfg /change standby-timeout-ac 0
powercfg /change standby-timeout-dc 0
powercfg /change hibernate-timeout-ac 0
powercfg /hibernate off

These commands disable or modify sleep and hibernation behavior. The apparent objective is to keep the machine continuously available. This behavior is especially relevant on laptops used by employees. A machine that remains awake and connected provides a better environment for remote management and command execution.

V7 Silent Endpoint Central Installation

The key command is effectively:

msiexec.exe /i “UEMSAgent.msi”
TRANSFORMS="UEMSAgent.mst"
ENABLESILENT=yes
REBOOT=ReallySuppress
INSTALLSOURCE=Manual
SERVER_ROOT_CRT="DMRootCA-Server.crt"
DS_ROOT_CRT="DMRootCA.crt"
/qn

The actor is not simply executing an unknown EXE. They are using the Windows Installer engine to install an Endpoint Central agent. /qn requests a completely silent installation.

V7 Agent Configuration

The supplied DCAgentServerInfo.json is arguably the most important artifact for understanding the purpose of the package. A legitimate Endpoint Central deployment can use a DCAgentServerInfo.json file to provide agent/server configuration. The difference here is where the configuration points. The important security observation is that the agent is being configured to communicate with an infrastructure endpoint that is not the organization’s known Endpoint Central server.

The supplied configuration identifies:

Product Code: DCEE
Agent Version: 11.3.2400.33.W
Remote Office ID: 301
Remote Office Management: enabled
Distribution Server: disabled
Proxy: disabled

and specifies an externally controlled server infrastructure, including:

134.122.175.217:8383

Upon reviewing the IP reputation and their ownership IP is related to CTG server limited, Singapore which is a cloud service provider.

The JSON also contains authentication material such as:

REMOTEOFFICEAUTHKEY — An authentication/authorization key associated with the Remote Office / Distribution Server (DS) communication.

DSAuthProps.VALUE1 & DSAuthProps.VALUE2 — Distribution Server authentication properties.

V9 Loader Analysis

V9 Architecture

V9 is best understood as an evolution of the same loader architecture rather than a completely different malware family. Its header explicitly describes itself as “V9 Universal Loader — Merged Edition” and states that it combines the V7 download resilience with V8 extraction improvements.

The overall chain remains:

V9 Improvements Over V7

The most obvious improvement is extraction reliability. V9 makes PowerShell Expand-Archive the first extraction method. The script uses:

powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden

and extracts the ZIP without displaying the traditional Shell.Application copy UI.

This is a meaningful operational improvement because the user is less likely to see a visible extraction window.

V9 also increases the extraction timeout from 30 seconds to 60 seconds and polls every 400 ms for the expected payload.

The V9 version also explicitly supports three download domains instead of relying on a single hard-coded infrastructure endpoint.

The supplied domains resolve conceptually to:

xiazaixitong8[.]com
xiazaitongdao[.]top
jb[.]CJIAN616[.]TOP

The script then appends:

/sys/<GROUP_ID>/1/c2b8.zip

The group value in this sample is:

GROUP_ID = “G”

This indicates that the infrastructure can potentially serve different payload configurations to different groups.

V9 Obfuscation

V9 continues the same lightweight obfuscation approach.

Examples include splitting strings:

“Scriptin” & “g.FileS” & “ystemObje” & “ct”

instead of directly writing:

Scripting.FileSystemObject

Other strings such as:

• Shell.Application
• Expand-Archive
• Accept
• User-Agent
• System32
• curl.exe

are similarly fragmented.

The script also contains a large quantity of meaningless variables, comments and expressions such as:

If 1 = 1 Then
Dim random_variable
random_variable = 60439
End If

These have little or no operational purpose. They are junk-code / analysis-noise padding.

V9 Anti-Analysis / Evasion Characteristics

V9 does not contain the type of sophisticated virtual-machine detection normally associated with advanced sandbox evasion.

Instead, it uses relatively low-level operational techniques:

• randomized startup delay;
• randomized filenames/directories;
• randomized User-Agent strings;
• HTTPS;
• multiple download mechanisms;
• multiple fallback domains;
• hidden PowerShell execution;
• silent extraction;
• silent MSI installation;
• cleanup of staging files;
• extensive junk code.

The random User-Agent implementation is particularly notable because it attempts to make outbound traffic look like ordinary browser traffic.

V9 Payload Installation

The V9 setup1.vbs differs from V7 in one important respect: it explicitly tests whether it already has administrative access. It attempts to write:

HKLM\SOFTWARE\_chk_adm

If successful, the script assumes administrative privileges.

If not, it invokes:

ShellExecute(…, “runas”, …)

and launches itself again with:

/elevated

This is a relatively straightforward privilege/elevation check. Once elevated, it runs the same fundamental MSI installation chain used by V7.

V9 Cleanup

After the MSI installation returns, V9 waits approximately five seconds and then attempts to delete the files in the staging directory. It then launches a detached command similar to:

cmd /c ping 127.0.0.1 -n 4 >nul & del /f /q “<setup1.vbs>” & rd /s /q “<directory>”

The ping command provides a short delay before attempting to delete the currently executing script and its parent directory.

V9 Agent Configuration

The V9 DCAgentServerInfo.json follows the same general Endpoint Central structure as V7.

It identifies:

productcode = DCEE
AGENTVERSION = 11.3.2400.33.W
UEMSProductCode = [DCEE]
REMOTEOFFICEID = 301
ENABLEREMOTEOFFICEMGMT = yes
ENABLESILENT = YES

The major difference is the configured server infrastructure.

V9 points to:

134.122.133.157:8383

rather than the V7 address:

134.122.175.217:8383

Upon reviewing the IP reputation and their ownership IP is related to CTG server limited, Singapore which is a cloud service provider.

What Can the Attacker Achieve?

The most important point is that the VBS loader itself is not necessarily the attacker’s final capability. Its purpose is to install and configure a remote-management agent.

If the Endpoint Central agent successfully registers with attacker-controlled infrastructure, the attacker can potentially obtain the capabilities available through that management framework. Depending on the privileges and components successfully installed, this can include remote administration, software deployment, configuration changes, inventory collection, patch-management operations and execution of commands/scripts through the management platform.

The presence of RemCom.exe provides an additional remote-execution capability.

The attacker may therefore be attempting to transform a normal employee workstation into a remotely manageable endpoint under their control.

This is particularly concerning in finance environments because compromised finance workstations may have access to accounting systems, banking portals, ERP applications, payment workflows, sensitive documents, customer information and privileged corporate applications.

IOCs:

jb[.]CJIAN616[.]TOP

xiazaixitong8[.]com

xiazaitongdao[.]top

jb[.]CJIAN616[.]TOP

134.122.175.217

134.122.133.157

ED5066D483B7249DC75FA4B0578108F96B8C91FB — RemCom.exe

7AEDB772303E860985424DA6AE5A5611A4F519BF — setup1.vbs

7F9F98F388ABDC938FC0C2D162233B93C822B809 — setup1.vbs

E71E083C47D6B5E83639304A116CBDA9F9816024 — statement of account.vbs

61CB61FA3A16F7180350A56A43DB433E8C45DA5D — E-statement.vbs

Actionable Recommendations

• Prevent standard users from executing .vbs files unless there is a documented business requirement. Use AppLocker/WDAC or equivalent application-control policies where possible.
• Restrict execution of scripts and executables from locations such as Downloads, Desktop, %Temp%, and C:\Users\Public. These locations are commonly abused for malware staging.
• Users should not have local administrator privileges unless specifically required. Require controlled administrative approval for software installation and privilege elevation.
• Allow only organization-approved remote-management tools and maintain an inventory of authorized installations. Investigate any unexpected Endpoint Central or other remote-management agent.
• Where not required for business operations, prevent installation and use of WhatsApp, Telegram, Discord, and similar consumer messaging applications on domain-managed endpoints.
• If messaging applications are required, closely monitor files downloaded through WhatsApp, Telegram, Discord, webmail, and similar platforms. Pay particular attention to scripts, executables, installers, and archive files.
• Educate users not to download or execute files from unverified sources, even when the filename appears to be an invoice, statement, payment document, or other legitimate business file.
• Users should verify unexpected financial statements, invoices, payment requests, or attachments with the sender through a trusted communication channel before opening them.
• Consider blocking or restricting potentially dangerous file types such as .vbs, .vbe, .js, .jse, .ps1, .bat, .cmd, .scr, .msi, and suspicious archive files where they are not required.
• Monitor for unusual PowerShell execution, particularly when PowerShell is launched by wscript.exe, cscript.exe, or other script interpreters.
• Alert on unexpected msiexec.exe activity, especially when installation packages originate from temporary folders, Downloads, Public folders, or are launched by scripts.
• Block known malicious domains and IP addresses at DNS, proxy, firewall, and EDR layers. Monitor endpoints communicating with unknown external management infrastructure.
• Detect unauthorized use of tools such as RemCom and other remote-execution utilities. Investigate their presence even if they are not detected as traditional malware.
• Apply stricter application-control, web-filtering, and monitoring policies to finance and other high-value systems due to their access to banking, ERP, payment, and sensitive financial information.
• Where feasible, allow users to execute only approved applications and scripts. This can significantly reduce the risk from malware delivered through email, downloads, and messaging platforms.
• Provide users with a simple process to report suspicious attachments or downloaded files. Users should avoid opening or testing suspicious files themselves and instead submit them to the IT/Security team for analysis.

Generalize Threat Hunting Queries:

1. VBScript execution and suspicious script chains

DeviceProcessEvents
| where FileName in~ ("wscript.exe", "cscript.exe")
| where ProcessCommandLine contains ".vbs"
| where
    ProcessCommandLine contains "//B"
    or ProcessCommandLine contains "//Nologo"
    or ProcessCommandLine contains "/elevated"
    or ProcessCommandLine matches regex @"(?i)(Users\\Public|AppData|Temp|Downloads|ProgramData|Documents)"
    or InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "msiexec.exe")

Covers: VBScript execution, silent switches, suspicious user-writable locations, and VBS → PowerShell/CMD/MSI chains.

2. PowerShell download, extraction, and evasion.

DeviceProcessEvents
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where
    ProcessCommandLine contains "Expand-Archive"
    or ProcessCommandLine contains "System.IO.Compression"
    or ProcessCommandLine contains "ZipFile"
    or ProcessCommandLine contains "ExtractToDirectory"
    or ProcessCommandLine contains "DownloadFile"
    or ProcessCommandLine contains "WebClient"
    or ProcessCommandLine contains "Invoke-WebRequest"
    or ProcessCommandLine contains "Net.WebClient"
    or ProcessCommandLine contains "ExecutionPolicy Bypass"
    or ProcessCommandLine contains "-WindowStyle Hidden"
    or ProcessCommandLine contains "ServerCertificateValidationCallback"
    or ProcessCommandLine contains "SecurityProtocol"

Covers: ZIP extraction, PowerShell downloads, hidden execution, execution-policy bypass, and TLS/certificate-validation manipulation.

3. LOLBin and suspicious download activity

DeviceProcessEvents
| where FileName in~ (
    "curl.exe",
    "wscript.exe",
    "cscript.exe",
    "powershell.exe",
    "pwsh.exe",
    "mshta.exe",
    "rundll32.exe",
    "regsvr32.exe"
)
| where
    ProcessCommandLine contains "http"
    or ProcessCommandLine contains " -o "
    or ProcessCommandLine contains "--output"
    or ProcessCommandLine contains "-L"

Covers: curl/PowerShell/script-interpreter download activity and broader LOLBin-based retrieval.

4. Suspicious archive staging and extracted payloads

DeviceFileEvents
| where
    (
        ActionType in~ ("FileCreated", "FileRenamed")
        and
        FolderPath matches regex @"(?i)(\\Users\\Public\\Documents\\|\\Users\\[^\\]+\\AppData\\|\\Users\\[^\\]+\\Downloads\\|\\Users\\[^\\]+\\Temp\\|\\ProgramData\\|\\Windows\\Temp\\)"
    )
    and
    (
        FileName endswith ".zip"
        or FileName endswith ".vbs"
        or FileName endswith ".ps1"
        or FileName endswith ".bat"
        or FileName endswith ".cmd"
        or FileName endswith ".msi"
        or FileName endswith ".mst"
        or FileName endswith ".exe"
        or FileName endswith ".dll"
        or FileName endswith ".crt"
        or FileName endswith ".json"
    )

5. MSI installation and suspicious software deployment

DeviceProcessEvents
| where FileName =~ "msiexec.exe"
| where
    ProcessCommandLine contains "UEMSAgent"
    or ProcessCommandLine contains "TRANSFORMS="
    or ProcessCommandLine contains ".mst"
    or ProcessCommandLine contains "/qn"
    or ProcessCommandLine contains "ENABLESILENT=yes"
    or ProcessCommandLine contains "REBOOT=ReallySuppress"
    or ProcessCommandLine contains "SERVER_ROOT_CRT"
    or ProcessCommandLine contains "DS_ROOT_CRT"
    or InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe", "powershell.exe", "cmd.exe")

Covers: UEMS installation, MST transforms, silent MSI deployment, certificate parameters, and script-driven installation

6. RemCom / remote-management tooling

DeviceProcessEvents
| where
    FileName =~ "RemCom.exe"
    or ProcessCommandLine contains "RemCom.exe"
    or ProcessCommandLine contains "RemCom"
    or ProcessCommandLine contains "remoteexec"
| where
    ProcessCommandLine matches regex @"(?i)(Users\\Public|AppData|Temp|ProgramData|Downloads|Documents)"
    or InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe", "powershell.exe", "cmd.exe")
    or FileName =~ "RemCom.exe"

Covers: RemCom execution, suspicious staging locations, and execution through the loader chain.

7. Privilege, system configuration, and cleanup behavior

DeviceProcessEvents
| where
    (
        FileName in~ ("wscript.exe", "cscript.exe", "powershell.exe")
        and (
            ProcessCommandLine contains "elevated"
            or ProcessCommandLine contains "runas"
            or ProcessCommandLine contains "HKLM"
            or ProcessCommandLine contains "_chk_adm"
        )
    )
    or
    (
        FileName =~ "powercfg.exe"
        and (
            ProcessCommandLine contains "standby-timeout"
            or ProcessCommandLine contains "hibernate-timeout"
            or ProcessCommandLine contains "/hibernate off"
        )
    )
    or
    (
        FileName =~ "cmd.exe"
        and (
            ProcessCommandLine contains "del /f"
            or ProcessCommandLine contains "rd /s"
            or ProcessCommandLine contains "rmdir"
            or (
                ProcessCommandLine contains "ping 127.0.0.1"
                and ProcessCommandLine contains "del"
            )
        )
    )

Covers: UAC/elevation behavior, HKLM changes, _chk_adm, power-setting modifications, and delayed/self-deletion

8. Network infrastructure

DeviceNetworkEvents
| where
    RemoteIP in~ (
        "134.122.175.217",
        "134.122.133.157"
    )
    or RemoteUrl contains "CJIAN616.TOP"
    or RemoteUrl contains "xiazaixitong8.com"
    or RemoteUrl contains "xiazaitongdao.top"
    or RemoteUrl contains "/sys/"
    or RemoteUrl contains "/1/"
    or RemoteUrl contains "c2b8.zip"
    or RemoteUrl endswith ".zip"