Analysis
-
max time kernel
68s -
max time network
118s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
29-10-2020 16:33
General
-
Target
c0695c4f73a5a26beaaf5402c949f0be.exe
-
Size
2.3MB
-
MD5
c0695c4f73a5a26beaaf5402c949f0be
-
SHA1
02356f440a5d13768657fe233e48bf9f8c3b1f17
-
SHA256
68313d4b45cc908f541dd581d7b9d1e8ccadcbf205714c12c36b58083ada7345
-
SHA512
eeecb03ee1324968eb8dfa48ece8b45ff80e22cb20c0288a1c4643cacee074e6279d8291b71f02aa38193e40db9f40bc2527b78879dd701440900e9eb6e55aa1
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Executes dropped EXE 1 IoCs
-
Drops startup file 1 IoCs
-
Loads dropped DLL 6 IoCs
-
JavaScript code in executable 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0695c4f73a5a26beaaf5402c949f0be.exe"C:\Users\Admin\AppData\Local\Temp\c0695c4f73a5a26beaaf5402c949f0be.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\CodeIntegrity\WinSupport\client32.exe"C:\Users\Admin\AppData\Roaming\CodeIntegrity\WinSupport\client32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-