Overview

overview

10

Static

static

1

localinstupdater.hta

windows7-x64

3

localinstupdater.hta

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    localinstupdater.hta

  • Size

    1.2MB

  • Sample

    230627-tb58wseg64

  • MD5

    1bab38a63bec0603d6244f5ca21688d8

  • SHA1

    38ea9e0f83f90afdcc639e5f61b86a2b97125166

  • SHA256

    598b36f688f03733f122a328177ed29b68d3b3a8f14ec281d13eabad59bb8254

  • SHA512

    36232e4ca3b5b6eff5524088205dbc3b20554e5730e79d1d5f790e1970cbf67027bfbfe622b3a540458337c44f0740b7556265b9657376dcac197c7ed5acf14c

  • SSDEEP

    3072:zZwbHBSr0Fty3VkZ6oaKIC5EmQhm0vIwPlfYiytP7hYsy:zCW0Fg320o71Qhm0vBPZYiyP7Gsy

Score
10/10
netsupportrat

Malware Config

Targets

    • Target

      localinstupdater.hta

    • Size

      1.2MB

    • MD5

      1bab38a63bec0603d6244f5ca21688d8

    • SHA1

      38ea9e0f83f90afdcc639e5f61b86a2b97125166

    • SHA256

      598b36f688f03733f122a328177ed29b68d3b3a8f14ec281d13eabad59bb8254

    • SHA512

      36232e4ca3b5b6eff5524088205dbc3b20554e5730e79d1d5f790e1970cbf67027bfbfe622b3a540458337c44f0740b7556265b9657376dcac197c7ed5acf14c

    • SSDEEP

      3072:zZwbHBSr0Fty3VkZ6oaKIC5EmQhm0vIwPlfYiytP7hYsy:zCW0Fg320o71Qhm0vBPZYiyP7Gsy

    Score
    10/10
    netsupportrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks