Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
14-06-2023 11:09
General
-
Target
client32.exe
-
Size
103KB
-
MD5
877f5e83fb39de16fa8bbd93ba9f07f1
-
SHA1
4ccc61ba1722484042734579dff6c1a97bd37366
-
SHA256
418744fa1ade539c280461387df87dda6bf84c7d755ebbbdc6123fd5659f9467
-
SHA512
e863e199267fe303e359339ee5b7b0888a2d17da6f56ac34cadda55f9d94a1297fa9f84b4dc9fdc6b6737a851c1352e655d96866543b6adc4b07cb708531b5cb
-
SSDEEP
384:Jh0wV5+6j6Qa86Fkv2Wr120hZE4vtV/CptVDikH:f/VZl6FhWr80/E4vtV6ptVDiy
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\client32.exe"C:\Users\Admin\AppData\Local\Temp\client32.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow