Analysis
-
max time kernel
139s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2023, 18:26
Static task
static1
Behavioral task
behavioral1
Sample
1497ee62ae8d86dfd030267cf3d29f91.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1497ee62ae8d86dfd030267cf3d29f91.exe
Resource
win10v2004-20230703-en
General
-
Target
1497ee62ae8d86dfd030267cf3d29f91.exe
-
Size
2.1MB
-
MD5
1497ee62ae8d86dfd030267cf3d29f91
-
SHA1
e70ff877a5799464f0ee057676858b37d1a4f2bd
-
SHA256
93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed
-
SHA512
0634eadf03628c899b82afe9e4e1ef7315ed5401ff3f8ab0c91038a8b7f4e3f886f1fef6cf4d3f62189e89ae66bce489085ef4727fd547a618da92d5b82f226f
-
SSDEEP
49152:VB6Ibm7IGGPVc9owLuHj2sST+rkzDFzuGRINd7wAfr4D:r6GLu9SD23+64RF4D
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation 1497ee62ae8d86dfd030267cf3d29f91.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autorunns12.ini.lnk 1497ee62ae8d86dfd030267cf3d29f91.exe -
Executes dropped EXE 1 IoCs
pid Process 3992 client32.exe -
Loads dropped DLL 5 IoCs
pid Process 3992 client32.exe 3992 client32.exe 3992 client32.exe 3992 client32.exe 3992 client32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSecurityPrivilege 3992 client32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3992 client32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1584 wrote to memory of 3992 1584 1497ee62ae8d86dfd030267cf3d29f91.exe 88 PID 1584 wrote to memory of 3992 1584 1497ee62ae8d86dfd030267cf3d29f91.exe 88 PID 1584 wrote to memory of 3992 1584 1497ee62ae8d86dfd030267cf3d29f91.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\1497ee62ae8d86dfd030267cf3d29f91.exe"C:\Users\Admin\AppData\Local\Temp\1497ee62ae8d86dfd030267cf3d29f91.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Roaming\UpdatwinSupp4354\client32.exe"C:\Users\Admin\AppData\Roaming\UpdatwinSupp4354\client32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3992
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
299KB
MD5369388ac78ca4ca8a64219cf9aafad4c
SHA1dfa6c01c55ac799f041c65df9a35aba8cf0d8c2d
SHA256c76ee648639406c81469772311c39b46042bf1b91e47d9201908f3cf70407f30
SHA5127d090f033ffc48b870d692877f3804a69dcb1ff61b96936f1ab77bf42b156839bfd787c387bc7d642c732868e3dcd8c0ff3b319f057c0157b5afc6843b302bc5
-
Filesize
299KB
MD5369388ac78ca4ca8a64219cf9aafad4c
SHA1dfa6c01c55ac799f041c65df9a35aba8cf0d8c2d
SHA256c76ee648639406c81469772311c39b46042bf1b91e47d9201908f3cf70407f30
SHA5127d090f033ffc48b870d692877f3804a69dcb1ff61b96936f1ab77bf42b156839bfd787c387bc7d642c732868e3dcd8c0ff3b319f057c0157b5afc6843b302bc5
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
259B
MD51dc87146379e5e3f85fd23b25889ae2a
SHA1b750c56c757ad430c9421803649acf9acd15a860
SHA256f7d80e323e7d0ed1e3ddd9b5df08af23dcecb47a3e289314134d4b76b3adcaf2
SHA5127861abe50eefdf4452e4baacc4b788895610196b387b70ddeab7bc70735391ed0a015f47eada94a368b82f8e5cedb5a2096e624f4a881ff067937ad159e3562c
-
Filesize
100KB
MD5f0d7d2a77eee2b3146405d3ad0d56230
SHA137c323faf58584606ee5847cb9a25346c588f78f
SHA256f043653ab1b8fbe5a33922df5b4fb46797e9694e5fcee807b97cc6aaef650131
SHA512861258b5b97665f649437fd25aadc5dc66e5bc5a87d7482300f9931810f0d89d0ed9c01890cd038daa7c6d2f1850a3208fc20b3c1dc2e588c7688e228a4baade
-
Filesize
8KB
MD507b474ab5c503f35873b94cd48d01592
SHA1e6f699d6c021d9d434cc6a4e68516c4c2ac80ddc
SHA256c8911c298f860de85037f8634e8539627f5a1c13b1fffe5568d63612e29b9cd4
SHA512a995b0d1fba6e99dd89afbf5161efc18b0268c001c27155876e642abc8639f79c2c320530039cfa5ec9f6ca10e1d716060b0fb86414245f578f920f11c9bbbc8
-
Filesize
3.3MB
MD51274cca13cc5e37ca94d35e5b0673e89
SHA1a8754c94f88273c304bc45a5afd61a383bb52117
SHA256cd5510c8bc7ea60be77ad4aab502ee02d871bf4e917aeeb6921c20eebd9693dd
SHA51252eafa31ee942dc92d0b8f52c12206f6abc1d5fae799b37b371e97c38ce66bd0693263de86b4880748ba1405054701288caf2cd00cd327edc164e1390cf9191c
-
Filesize
3.3MB
MD51274cca13cc5e37ca94d35e5b0673e89
SHA1a8754c94f88273c304bc45a5afd61a383bb52117
SHA256cd5510c8bc7ea60be77ad4aab502ee02d871bf4e917aeeb6921c20eebd9693dd
SHA51252eafa31ee942dc92d0b8f52c12206f6abc1d5fae799b37b371e97c38ce66bd0693263de86b4880748ba1405054701288caf2cd00cd327edc164e1390cf9191c
-
Filesize
101KB
MD5c4f1b50e3111d29774f7525039ff7086
SHA157539c95cba0986ec8df0fcdea433e7c71b724c6
SHA25618df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
SHA512005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
-
Filesize
101KB
MD5c4f1b50e3111d29774f7525039ff7086
SHA157539c95cba0986ec8df0fcdea433e7c71b724c6
SHA25618df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
SHA512005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
-
Filesize
101KB
MD5c4f1b50e3111d29774f7525039ff7086
SHA157539c95cba0986ec8df0fcdea433e7c71b724c6
SHA25618df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
SHA512005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
-
Filesize
1KB
MD53f4686b1c2e6d44110bee11e61ee4533
SHA1ca7d0e453c3ed22235b2d9137ac595c1318bffbe
SHA2567092327e20574cf9a3c3e90022adee5184b84b8478c8e7cd3f391f76cb4526f2
SHA5126d3f032d2a286b7505c8777f9efc3feaec293ff8b7ef6ba66c65e368a7843cee2cc0aa29d8efb49fa858fa71ee902d71bdfd3e0218b2fa2c2524d38776ef3ce6
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
100KB
MD5f0d7d2a77eee2b3146405d3ad0d56230
SHA137c323faf58584606ee5847cb9a25346c588f78f
SHA256f043653ab1b8fbe5a33922df5b4fb46797e9694e5fcee807b97cc6aaef650131
SHA512861258b5b97665f649437fd25aadc5dc66e5bc5a87d7482300f9931810f0d89d0ed9c01890cd038daa7c6d2f1850a3208fc20b3c1dc2e588c7688e228a4baade
-
Filesize
8KB
MD507b474ab5c503f35873b94cd48d01592
SHA1e6f699d6c021d9d434cc6a4e68516c4c2ac80ddc
SHA256c8911c298f860de85037f8634e8539627f5a1c13b1fffe5568d63612e29b9cd4
SHA512a995b0d1fba6e99dd89afbf5161efc18b0268c001c27155876e642abc8639f79c2c320530039cfa5ec9f6ca10e1d716060b0fb86414245f578f920f11c9bbbc8