Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03-02-2024 16:35

General

  • Target

    8cd067bd2a3245b62f0411ca93594b1b.exe

  • Size

    2.0MB

  • MD5

    8cd067bd2a3245b62f0411ca93594b1b

  • SHA1

    8990a65174443066e7a54e03f790ba2c23459b9f

  • SHA256

    8075a6c09ff4c8e8637128dc8500d59fc6b2e24fcfe34b7bc782c079f10428fa

  • SHA512

    c5082fe55e18f68f56925b299913db35b5d43419087555dc1f9a866d383cbbae9ccc87d6cde7626d9dce3b3240d547342cabe448eb0a49900952fcd3738a054a

  • SSDEEP

    49152:6YADFHzPIldt9QFm0yfR0MRhYHAoniaq01LOXLtF81U:6T6ldQyHhYbBd1L0XAU

Score
10/10

Malware Config

Signatures

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8cd067bd2a3245b62f0411ca93594b1b.exe
    "C:\Users\Admin\AppData\Local\Temp\8cd067bd2a3245b62f0411ca93594b1b.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Users\Admin\AppData\Roaming\WinSupport\client32.exe
      "C:\Users\Admin\AppData\Roaming\WinSupport\client32.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\WinSupport\NSM.LIC

    Filesize

    254B

    MD5

    8614c2008044a081e9d26d8db1571f4a

    SHA1

    1b007f05c289d0b71d542520b25fe65c6b6fcbe3

    SHA256

    df622fc8bc605023730d3ad952d69fcbd8383ce5440d63da0df20fb139355ec9

    SHA512

    449244a508daaacde53078b826f7b482650acc3f61e8235fa892a737bebbecb178061d0aa1e99cd74da7885c86cebb2727d6e85384ecd68187d7e6e94f018ae9

  • C:\Users\Admin\AppData\Roaming\WinSupport\PCICL32.dll

    Filesize

    3.3MB

    MD5

    287034270e3dba21671932ed8352727b

    SHA1

    60b1180941a78c487c37cae1f7d61c8fe7c94896

    SHA256

    b45cecc6bb0e1c0fb0758edb22490d1ab47de6d2feff31fb641dcc0a313ec602

    SHA512

    598b499dd58d4a86cd1b1d3eb7d6fcfa7d9aef2ee020a6ed21f1094afe0646e6780ab34cb3e9b7e05d58432d1020cc2ac09a7c70502ce07e24711e9c985856a0

  • C:\Users\Admin\AppData\Roaming\WinSupport\client32.ini

    Filesize

    793B

    MD5

    348247b5c9e5762245f79ade1b2c53fe

    SHA1

    283bdb541b1649da56768da106908f0935c55c56

    SHA256

    b2a0e55605b899eccba3e57d29b2c2a0033d27a0ad76d8202c51fa90c67507e5

    SHA512

    69d49a8b6ed39d822206a6df9c6967fad401341559a2a98e7ab7d302ae909886718da7d61e7809817805b3a0526c04f79cb9862ee477ba57e42f15f317f0d9cf

  • \Users\Admin\AppData\Roaming\WinSupport\HTCTL32.DLL

    Filesize

    320KB

    MD5

    2d3b207c8a48148296156e5725426c7f

    SHA1

    ad464eb7cf5c19c8a443ab5b590440b32dbc618f

    SHA256

    edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

    SHA512

    55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

  • \Users\Admin\AppData\Roaming\WinSupport\PCICHEK.DLL

    Filesize

    18KB

    MD5

    a0b9388c5f18e27266a31f8c5765b263

    SHA1

    906f7e94f841d464d4da144f7c858fa2160e36db

    SHA256

    313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

    SHA512

    6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

  • \Users\Admin\AppData\Roaming\WinSupport\PCICL32.DLL

    Filesize

    2.8MB

    MD5

    c984fdc831911ea8ad0a772a8166cab7

    SHA1

    93254b08d183b7cc0c5a8b3ebf958f5f9ad94ea0

    SHA256

    3a85e0eab1142917b7f4d6b465d1a145d53be8936183386cc4761e5b3e169cf6

    SHA512

    ad0f4124b7c9813ad6f2546d6a85f41eaa26aa0eaf5396881c9dbb883ff39768628f3e008898c1e14055a8622ebd21f8a86dcb296a50deb42c549ca1341bd102

  • \Users\Admin\AppData\Roaming\WinSupport\TCCTL32.DLL

    Filesize

    387KB

    MD5

    eab603d12705752e3d268d86dff74ed4

    SHA1

    01873977c871d3346d795cf7e3888685de9f0b16

    SHA256

    6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea

    SHA512

    77de0d9c93ccba967db70b280a85a770b3d8bea3b707b1abb037b2826b48898fec87924e1a6cce218c43478e5209e9eb9781051b4c3b450bea3cd27dbd32c7f3

  • \Users\Admin\AppData\Roaming\WinSupport\client32.exe

    Filesize

    104KB

    MD5

    f76954b68cc390f8009f1a052283a740

    SHA1

    3112a39aad950045d6422fb2abe98bed05931e6c

    SHA256

    63315df7981130853d75dc753e5776bdf371811bcfce351557c1e45afdd1ebfb

    SHA512

    d3aea0867b488161f62e43e7c250ad3917713b8b183139fb6e06c71594fb0cec769e1494b7cc257117992ae4aa891e056f99c25431ae19f032b1ba779051a880

  • \Users\Admin\AppData\Roaming\WinSupport\msvcr100.dll

    Filesize

    755KB

    MD5

    0e37fbfa79d349d672456923ec5fbbe3

    SHA1

    4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

    SHA256

    8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

    SHA512

    2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

  • \Users\Admin\AppData\Roaming\WinSupport\pcicapi.dll

    Filesize

    32KB

    MD5

    dcde2248d19c778a41aa165866dd52d0

    SHA1

    7ec84be84fe23f0b0093b647538737e1f19ebb03

    SHA256

    9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

    SHA512

    c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166