Analysis
- max time kernel
121s - max time network
262s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
10/01/2024, 15:45
General
- Target mref.exe
- Size 103KB
- Sample240110-s7ev5sbbe4
- SHA256 49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3
Score
10/10
Malware Config
Signatures
- NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\mref.exe"C:\Users\Admin\AppData\Local\Temp\mref.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow