Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03-02-2024 16:35
Static task
static1
Behavioral task
behavioral1
Sample
8cd067bd2a3245b62f0411ca93594b1b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8cd067bd2a3245b62f0411ca93594b1b.exe
Resource
win10v2004-20231222-en
General
-
Target
8cd067bd2a3245b62f0411ca93594b1b.exe
-
Size
2.0MB
-
MD5
8cd067bd2a3245b62f0411ca93594b1b
-
SHA1
8990a65174443066e7a54e03f790ba2c23459b9f
-
SHA256
8075a6c09ff4c8e8637128dc8500d59fc6b2e24fcfe34b7bc782c079f10428fa
-
SHA512
c5082fe55e18f68f56925b299913db35b5d43419087555dc1f9a866d383cbbae9ccc87d6cde7626d9dce3b3240d547342cabe448eb0a49900952fcd3738a054a
-
SSDEEP
49152:6YADFHzPIldt9QFm0yfR0MRhYHAoniaq01LOXLtF81U:6T6ldQyHhYbBd1L0XAU
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Drops startup file 1 IoCs
Processes:
8cd067bd2a3245b62f0411ca93594b1b.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autoruning.ini.lnk 8cd067bd2a3245b62f0411ca93594b1b.exe -
Executes dropped EXE 1 IoCs
Processes:
client32.exepid process 2420 client32.exe -
Loads dropped DLL 8 IoCs
Processes:
8cd067bd2a3245b62f0411ca93594b1b.execlient32.exepid process 2672 8cd067bd2a3245b62f0411ca93594b1b.exe 2672 8cd067bd2a3245b62f0411ca93594b1b.exe 2420 client32.exe 2420 client32.exe 2420 client32.exe 2420 client32.exe 2420 client32.exe 2420 client32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
client32.exedescription pid process Token: SeSecurityPrivilege 2420 client32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
client32.exepid process 2420 client32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
8cd067bd2a3245b62f0411ca93594b1b.exedescription pid process target process PID 2672 wrote to memory of 2420 2672 8cd067bd2a3245b62f0411ca93594b1b.exe client32.exe PID 2672 wrote to memory of 2420 2672 8cd067bd2a3245b62f0411ca93594b1b.exe client32.exe PID 2672 wrote to memory of 2420 2672 8cd067bd2a3245b62f0411ca93594b1b.exe client32.exe PID 2672 wrote to memory of 2420 2672 8cd067bd2a3245b62f0411ca93594b1b.exe client32.exe PID 2672 wrote to memory of 2420 2672 8cd067bd2a3245b62f0411ca93594b1b.exe client32.exe PID 2672 wrote to memory of 2420 2672 8cd067bd2a3245b62f0411ca93594b1b.exe client32.exe PID 2672 wrote to memory of 2420 2672 8cd067bd2a3245b62f0411ca93594b1b.exe client32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cd067bd2a3245b62f0411ca93594b1b.exe"C:\Users\Admin\AppData\Local\Temp\8cd067bd2a3245b62f0411ca93594b1b.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Roaming\WinSupport\client32.exe"C:\Users\Admin\AppData\Roaming\WinSupport\client32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2420
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254B
MD58614c2008044a081e9d26d8db1571f4a
SHA11b007f05c289d0b71d542520b25fe65c6b6fcbe3
SHA256df622fc8bc605023730d3ad952d69fcbd8383ce5440d63da0df20fb139355ec9
SHA512449244a508daaacde53078b826f7b482650acc3f61e8235fa892a737bebbecb178061d0aa1e99cd74da7885c86cebb2727d6e85384ecd68187d7e6e94f018ae9
-
Filesize
3.3MB
MD5287034270e3dba21671932ed8352727b
SHA160b1180941a78c487c37cae1f7d61c8fe7c94896
SHA256b45cecc6bb0e1c0fb0758edb22490d1ab47de6d2feff31fb641dcc0a313ec602
SHA512598b499dd58d4a86cd1b1d3eb7d6fcfa7d9aef2ee020a6ed21f1094afe0646e6780ab34cb3e9b7e05d58432d1020cc2ac09a7c70502ce07e24711e9c985856a0
-
Filesize
793B
MD5348247b5c9e5762245f79ade1b2c53fe
SHA1283bdb541b1649da56768da106908f0935c55c56
SHA256b2a0e55605b899eccba3e57d29b2c2a0033d27a0ad76d8202c51fa90c67507e5
SHA51269d49a8b6ed39d822206a6df9c6967fad401341559a2a98e7ab7d302ae909886718da7d61e7809817805b3a0526c04f79cb9862ee477ba57e42f15f317f0d9cf
-
Filesize
320KB
MD52d3b207c8a48148296156e5725426c7f
SHA1ad464eb7cf5c19c8a443ab5b590440b32dbc618f
SHA256edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796
SHA51255c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c
-
Filesize
18KB
MD5a0b9388c5f18e27266a31f8c5765b263
SHA1906f7e94f841d464d4da144f7c858fa2160e36db
SHA256313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
SHA5126051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd
-
Filesize
2.8MB
MD5c984fdc831911ea8ad0a772a8166cab7
SHA193254b08d183b7cc0c5a8b3ebf958f5f9ad94ea0
SHA2563a85e0eab1142917b7f4d6b465d1a145d53be8936183386cc4761e5b3e169cf6
SHA512ad0f4124b7c9813ad6f2546d6a85f41eaa26aa0eaf5396881c9dbb883ff39768628f3e008898c1e14055a8622ebd21f8a86dcb296a50deb42c549ca1341bd102
-
Filesize
387KB
MD5eab603d12705752e3d268d86dff74ed4
SHA101873977c871d3346d795cf7e3888685de9f0b16
SHA2566795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea
SHA51277de0d9c93ccba967db70b280a85a770b3d8bea3b707b1abb037b2826b48898fec87924e1a6cce218c43478e5209e9eb9781051b4c3b450bea3cd27dbd32c7f3
-
Filesize
104KB
MD5f76954b68cc390f8009f1a052283a740
SHA13112a39aad950045d6422fb2abe98bed05931e6c
SHA25663315df7981130853d75dc753e5776bdf371811bcfce351557c1e45afdd1ebfb
SHA512d3aea0867b488161f62e43e7c250ad3917713b8b183139fb6e06c71594fb0cec769e1494b7cc257117992ae4aa891e056f99c25431ae19f032b1ba779051a880
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
32KB
MD5dcde2248d19c778a41aa165866dd52d0
SHA17ec84be84fe23f0b0093b647538737e1f19ebb03
SHA2569074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917
SHA512c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166