Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/07/2023, 01:06
Static task
static1
Behavioral task
behavioral1
Sample
93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed.exe
Resource
win10v2004-20230703-en
General
-
Target
93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed.exe
-
Size
2.1MB
-
MD5
1497ee62ae8d86dfd030267cf3d29f91
-
SHA1
e70ff877a5799464f0ee057676858b37d1a4f2bd
-
SHA256
93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed
-
SHA512
0634eadf03628c899b82afe9e4e1ef7315ed5401ff3f8ab0c91038a8b7f4e3f886f1fef6cf4d3f62189e89ae66bce489085ef4727fd547a618da92d5b82f226f
-
SSDEEP
49152:VB6Ibm7IGGPVc9owLuHj2sST+rkzDFzuGRINd7wAfr4D:r6GLu9SD23+64RF4D
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation 93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autorunns12.ini.lnk 93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed.exe -
Executes dropped EXE 1 IoCs
pid Process 3904 client32.exe -
Loads dropped DLL 5 IoCs
pid Process 3904 client32.exe 3904 client32.exe 3904 client32.exe 3904 client32.exe 3904 client32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSecurityPrivilege 3904 client32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3904 client32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3116 wrote to memory of 3904 3116 93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed.exe 86 PID 3116 wrote to memory of 3904 3116 93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed.exe 86 PID 3116 wrote to memory of 3904 3116 93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed.exe"C:\Users\Admin\AppData\Local\Temp\93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Roaming\UpdatwinSupp4354\client32.exe"C:\Users\Admin\AppData\Roaming\UpdatwinSupp4354\client32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3904
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
299KB
MD5369388ac78ca4ca8a64219cf9aafad4c
SHA1dfa6c01c55ac799f041c65df9a35aba8cf0d8c2d
SHA256c76ee648639406c81469772311c39b46042bf1b91e47d9201908f3cf70407f30
SHA5127d090f033ffc48b870d692877f3804a69dcb1ff61b96936f1ab77bf42b156839bfd787c387bc7d642c732868e3dcd8c0ff3b319f057c0157b5afc6843b302bc5
-
Filesize
299KB
MD5369388ac78ca4ca8a64219cf9aafad4c
SHA1dfa6c01c55ac799f041c65df9a35aba8cf0d8c2d
SHA256c76ee648639406c81469772311c39b46042bf1b91e47d9201908f3cf70407f30
SHA5127d090f033ffc48b870d692877f3804a69dcb1ff61b96936f1ab77bf42b156839bfd787c387bc7d642c732868e3dcd8c0ff3b319f057c0157b5afc6843b302bc5
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
259B
MD51dc87146379e5e3f85fd23b25889ae2a
SHA1b750c56c757ad430c9421803649acf9acd15a860
SHA256f7d80e323e7d0ed1e3ddd9b5df08af23dcecb47a3e289314134d4b76b3adcaf2
SHA5127861abe50eefdf4452e4baacc4b788895610196b387b70ddeab7bc70735391ed0a015f47eada94a368b82f8e5cedb5a2096e624f4a881ff067937ad159e3562c
-
Filesize
100KB
MD5f0d7d2a77eee2b3146405d3ad0d56230
SHA137c323faf58584606ee5847cb9a25346c588f78f
SHA256f043653ab1b8fbe5a33922df5b4fb46797e9694e5fcee807b97cc6aaef650131
SHA512861258b5b97665f649437fd25aadc5dc66e5bc5a87d7482300f9931810f0d89d0ed9c01890cd038daa7c6d2f1850a3208fc20b3c1dc2e588c7688e228a4baade
-
Filesize
8KB
MD507b474ab5c503f35873b94cd48d01592
SHA1e6f699d6c021d9d434cc6a4e68516c4c2ac80ddc
SHA256c8911c298f860de85037f8634e8539627f5a1c13b1fffe5568d63612e29b9cd4
SHA512a995b0d1fba6e99dd89afbf5161efc18b0268c001c27155876e642abc8639f79c2c320530039cfa5ec9f6ca10e1d716060b0fb86414245f578f920f11c9bbbc8
-
Filesize
3.3MB
MD51274cca13cc5e37ca94d35e5b0673e89
SHA1a8754c94f88273c304bc45a5afd61a383bb52117
SHA256cd5510c8bc7ea60be77ad4aab502ee02d871bf4e917aeeb6921c20eebd9693dd
SHA51252eafa31ee942dc92d0b8f52c12206f6abc1d5fae799b37b371e97c38ce66bd0693263de86b4880748ba1405054701288caf2cd00cd327edc164e1390cf9191c
-
Filesize
3.3MB
MD51274cca13cc5e37ca94d35e5b0673e89
SHA1a8754c94f88273c304bc45a5afd61a383bb52117
SHA256cd5510c8bc7ea60be77ad4aab502ee02d871bf4e917aeeb6921c20eebd9693dd
SHA51252eafa31ee942dc92d0b8f52c12206f6abc1d5fae799b37b371e97c38ce66bd0693263de86b4880748ba1405054701288caf2cd00cd327edc164e1390cf9191c
-
Filesize
101KB
MD5c4f1b50e3111d29774f7525039ff7086
SHA157539c95cba0986ec8df0fcdea433e7c71b724c6
SHA25618df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
SHA512005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
-
Filesize
101KB
MD5c4f1b50e3111d29774f7525039ff7086
SHA157539c95cba0986ec8df0fcdea433e7c71b724c6
SHA25618df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
SHA512005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
-
Filesize
101KB
MD5c4f1b50e3111d29774f7525039ff7086
SHA157539c95cba0986ec8df0fcdea433e7c71b724c6
SHA25618df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
SHA512005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
-
Filesize
1KB
MD53f4686b1c2e6d44110bee11e61ee4533
SHA1ca7d0e453c3ed22235b2d9137ac595c1318bffbe
SHA2567092327e20574cf9a3c3e90022adee5184b84b8478c8e7cd3f391f76cb4526f2
SHA5126d3f032d2a286b7505c8777f9efc3feaec293ff8b7ef6ba66c65e368a7843cee2cc0aa29d8efb49fa858fa71ee902d71bdfd3e0218b2fa2c2524d38776ef3ce6
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
100KB
MD5f0d7d2a77eee2b3146405d3ad0d56230
SHA137c323faf58584606ee5847cb9a25346c588f78f
SHA256f043653ab1b8fbe5a33922df5b4fb46797e9694e5fcee807b97cc6aaef650131
SHA512861258b5b97665f649437fd25aadc5dc66e5bc5a87d7482300f9931810f0d89d0ed9c01890cd038daa7c6d2f1850a3208fc20b3c1dc2e588c7688e228a4baade
-
Filesize
8KB
MD507b474ab5c503f35873b94cd48d01592
SHA1e6f699d6c021d9d434cc6a4e68516c4c2ac80ddc
SHA256c8911c298f860de85037f8634e8539627f5a1c13b1fffe5568d63612e29b9cd4
SHA512a995b0d1fba6e99dd89afbf5161efc18b0268c001c27155876e642abc8639f79c2c320530039cfa5ec9f6ca10e1d716060b0fb86414245f578f920f11c9bbbc8