Analysis
-
max time kernel
113s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
29-10-2020 16:41
General
-
Target
eb3b4267.bin.exe
-
Size
2.1MB
-
MD5
fe5b9802204418aa5238c4d2a16d799c
-
SHA1
eaf47425d900150ceb5f0e88e5e7d08e4634bb20
-
SHA256
0f170f04c03a6aeb1b60fc29b053fcc981de9229f0aa60ddf7988d3bb3167c23
-
SHA512
98d6aa61d479adec304b63b9fb07e611767f7f27d3fb2cf267895264100d6d2c4cde92803be9a9216990df9962ebdf84eb39986da7115b36742837300e14707d
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Executes dropped EXE 1 IoCs
-
Drops startup file 1 IoCs
-
Loads dropped DLL 6 IoCs
-
JavaScript code in executable 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb3b4267.bin.exe"C:\Users\Admin\AppData\Local\Temp\eb3b4267.bin.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\CodeIntegrity\WinSupport\client32.exe"C:\Users\Admin\AppData\Roaming\CodeIntegrity\WinSupport\client32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-