Overview

overview

10

Static

static

1

C8449615CB...F9.exe

windows7-x64

10

C8449615CB...F9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    C8449615CBBD5105E7894FDCA6C5E9B278CE7692A0AF9.exe

  • Size

    2.7MB

  • Sample

    230327-e234wsbf57

  • MD5

    bf544c611cfb3d368804c5d30a7f5308

  • SHA1

    fb18778b66c54bcc0f1390acdcfacaf8da320215

  • SHA256

    c8449615cbbd5105e7894fdca6c5e9b278ce7692a0af96d4540c332df49b8eb2

  • SHA512

    9fd561729ea6493ac3b739cd4aea72a3c3b97765db4fc05e2278012d69d39dabfa4bfc35d1a0a44291c3e64836999a0716fed612f0dc0ce540583fa75d5822d8

  • SSDEEP

    49152:SKINhiFm5Dz8twrCSzcB5ALEgFigntylPIVQgD0m2w2d+C3gLh4n2:agA5ktwrBzcPtYslPp+0fd+C3gt

Score
10/10
netsupportpersistencerat

Malware Config

Targets

    • Target

      C8449615CBBD5105E7894FDCA6C5E9B278CE7692A0AF9.exe

    • Size

      2.7MB

    • MD5

      bf544c611cfb3d368804c5d30a7f5308

    • SHA1

      fb18778b66c54bcc0f1390acdcfacaf8da320215

    • SHA256

      c8449615cbbd5105e7894fdca6c5e9b278ce7692a0af96d4540c332df49b8eb2

    • SHA512

      9fd561729ea6493ac3b739cd4aea72a3c3b97765db4fc05e2278012d69d39dabfa4bfc35d1a0a44291c3e64836999a0716fed612f0dc0ce540583fa75d5822d8

    • SSDEEP

      49152:SKINhiFm5Dz8twrCSzcB5ALEgFigntylPIVQgD0m2w2d+C3gLh4n2:agA5ktwrBzcPtYslPp+0fd+C3gt

    Score
    10/10
    netsupportpersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks