Analysis
- max time kernel
90s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
26/09/2022, 06:20
General
- Target indicative_exchange_rates_dtd_26_09_2022_pdf.exe
- Size 2.6MB
- Sample220926-g3rhlahga3
- SHA256 c4841e9b7456e77872f4ac49d68c54d26df696ce090833f4449ae7bf5057eb0f
Score
10/10
Malware Config
Signatures
- NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- Executes dropped EXE 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Loads dropped DLL 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\indicative_exchange_rates_dtd_26_09_2022_pdf.exe"C:\Users\Admin\AppData\Local\Temp\indicative_exchange_rates_dtd_26_09_2022_pdf.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\BfVeRdDs41\client32.exe"C:\Users\Admin\AppData\Roaming\BfVeRdDs41\client32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
HTCTL32.DLL
HTCTL32.DLL
MSVCR100.dll
NSM.LIC
PCICHEK.DLL
PCICL32.DLL
PCICL32.dll
client32.exe
client32.exe
client32.ini
msvcr100.dll
msvcr100.dll
pcicapi.dll
pcicapi.dll
pcichek.dll