Overview

overview

10

Static

static

7

29ada151e3...03.exe

windows7-x64

10

29ada151e3...03.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/02/2024, 17:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    29ada151e3522de32e9a00d4fb80c703.exe
  • Size 20.6MB
  • Sample240220-we54eacf3z
  • SHA256 7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
netsupportpersistenceratupx

Malware Config

Signatures

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 43 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Blocklisted process makes network request 1 IoCs
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 36 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 24 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 21 IoCs
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\29ada151e3522de32e9a00d4fb80c703.exe
    "C:\Users\Admin\AppData\Local\Temp\29ada151e3522de32e9a00d4fb80c703.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3084
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7261.tmp\Install.bat" "
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7261.tmp\ns.msi" /qn /quiet /promptrestart
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3804
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\SYSTEM\ControlSet001\services\Client32 /f /v DisplayName /t REG_SZ /d "PCHelper ôñá½Ñ¡¡δ⌐ »«¼«Θ¡¿¬"
        3⤵
        • Modifies registry key
        PID:2008
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4784
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4F195369AA7229311D572A2454B62B78
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:4040
    • C:\Windows\system32\cmd.exe
      cmd.exe /c ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{64893459-B4B8-403D-8E2D-8395D2BA3F1F}\\nsm.lic"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Windows\SysWOW64\attrib.exe
        ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{64893459-B4B8-403D-8E2D-8395D2BA3F1F}\\nsm.lic"
        3⤵
        • Views/modifies file attributes
        PID:4064
    • C:\Windows\Installer\MSI8EB1.tmp
      "C:\Windows\Installer\MSI8EB1.tmp" NSConnSvrUI.exe NSN
      2⤵
      • Executes dropped EXE
      PID:4396
    • C:\Windows\Installer\MSI8F5E.tmp
      "C:\Windows\Installer\MSI8F5E.tmp" NewShortcut1_DC174CC2D1F545EBA5FA9A05CD201FFD.exe NSN
      2⤵
      • Executes dropped EXE
      PID:1764
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding E3BBCF0EDA3229323132C556FB621371 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      PID:532
    • C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\checkdvd.exe
      "C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\checkdvd.exe"
      2⤵
      • Executes dropped EXE
      PID:2276
    • C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\WINSTALL.EXE
      "C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\WINSTALL.EXE" /EV"NetSupport School" /EF".\Log Files" /EF".\Bookmarks" /EF".\Tests" /EF".\Store" /EF".\inv" /EA /EX /EC /Q /V /Q /I *
      2⤵
      • Sets service image path in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3656
      • C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\winst64.exe
        winst64.exe /q /q /i
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Registers COM server for autorun
        • Drops file in System32 directory
        • Modifies registry class
        PID:1544
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 1C5A71CA3EF9DC1DE9E9B9DEDDDFFA5F M Global\MSI0000
      2⤵
      • Modifies registry class
      PID:1668
    • C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\WINSTALL.EXE
      "C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\WINSTALL.EXE" /EI
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:968
  • C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32.exe
    "C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32.exe" /* *
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32.exe
      "C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32.exe" * /VistaUI
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:2040
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
    • Modifies data under HKEY_USERS
    PID:4936

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5780eb.rbs
        • Path C:\Config.Msi\e5780eb.rbs
        • Size 40KB
        • SHA256 0402441fcfcacb7db1a90868ff5942d7095cc45c8c832f5c7b4faace0c1771cd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WINSTALL.EXE
        • Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\WINSTALL.EXE
        • Size 637KB
        • SHA256 01b4a00bf69b151e4dbedc5273739388fe59697477d5848219a5f54cafe7faf1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        checkdvd.exe
        • Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\checkdvd.exe
        • Size 396KB
        • SHA256 a51fa80689ca5af9ee74995a8e6c6f0b3b63b21b8eea53981836cbda4dcdc736
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        client32provider.dll
        • Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32provider.dll
        • Size 82KB
        • SHA256 ac455c89a8c167cf6552613a7adfc66f62ad15c35f6ebeb5c32fe8565c68d72c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nskbfltr.sys
        • Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\nskbfltr.sys
        • Size 33KB
        • SHA256 e7e628de2ed025ad146328e86fa7ab83a79962972cc847263f984edc567d6e7c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pcimsg.dll
        • Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\pcimsg.dll
        • Size 37KB
        • SHA256 cc905356821f51db8e4ee2ec96f44b28cbc1f817cb6f147b0abef41233280d42
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        product.dat
        • Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\product.dat
        • Size 506B
        • SHA256 065d817596d710d5a06060241acc207b82b844530cc56ff842ff53d8ff92a075
        • MD5 SHA1 SHA512
        Submit Download

        shfolder.dll
        • Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\shfolder.dll
        • Size 28KB
        • SHA256 3419e795ff8ae1e2c188a45b9a31c77a7fb15a45684fcbe70c220945c63422c7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        winst64.exe
        • Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\winst64.exe
        • Size 69KB
        • SHA256 3603f955a5051c70651418ced3a6cb440fa0a6f7a533942eeafdd995bec1b7ff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        winst64.exe
        • Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\winst64.exe
        • Size 127KB
        • SHA256 15d7d3c8cd9654fc6e52cd77d674bced7b57c9710f4e615fe8630fd2282d3618
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Client32.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7261.tmp\Client32.ini
        • Size 1KB
        • SHA256 153dc072bc02d29f33e826a9116ee13094dc87eb83956aa48bd604a8d9aa3d7c
        • MD5 SHA1 SHA512
        Submit Download

        Install.bat
        • Path C:\Users\Admin\AppData\Local\Temp\7261.tmp\Install.bat
        • Size 312B
        • SHA256 cacd72fe9928925d9e2f08d0e551ce63c2415d31e3987e90a727841f7d8ea791
        • MD5 SHA1 SHA512
        Submit Download

        NSM.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7261.tmp\NSM.ini
        • Size 69B
        • SHA256 011c851c57cbec1d827b3d129c6786d60bbf82460254a4a5b2ad292ab83c9b22
        • MD5 SHA1 SHA512
        Submit Download

        NSM.lic
        • Path C:\Users\Admin\AppData\Local\Temp\7261.tmp\NSM.lic
        • Size 255B
        • SHA256 61cfdefd60d4839a8d38b4e2483f68c26b7e2b8dbbe697e75679b7f03b292b67
        • MD5 SHA1 SHA512
        Submit Download

        ns.msi
        • Path C:\Users\Admin\AppData\Local\Temp\7261.tmp\ns.msi
        • Size 2.1MB
        • SHA256 8ef70d0d679ee323847b9defd9e2fe60fc135fde03c6fab94660a38aa4616f56
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DLL_{64893459-B4B8-403D-8E2D-8395D2BA3F1F}.ini
        • Path C:\Users\Admin\AppData\Local\Temp\DLL_{64893459-B4B8-403D-8E2D-8395D2BA3F1F}.ini
        • Size 1KB
        • SHA256 d586a1c41ccccecb07cb489d0255960d729a18d651c3801cc3b1f72841dc73ab
        • MD5 SHA1 SHA512
        Submit Download

        Client32.upd
        • Path C:\Users\Admin\AppData\Local\Temp\{64893459-B4B8-403D-8E2D-8395D2BA3F1F}\Client32.upd
        • Size 25B
        • SHA256 00e0c629d5645c15df66adcf99e8a0a3e517d7a7876141ae7a752f0585eec047
        • MD5 SHA1 SHA512
        Submit Download

        NSM.LIC
        • Path C:\Users\Admin\AppData\Local\Temp\{64893459-B4B8-403D-8E2D-8395D2BA3F1F}\NSM.LIC
        • Size 255B
        • SHA256 64c45c70743b974f63e8d85ffa30cc96d9788e3bad730fd96d9bf8068777eb5c
        • MD5 SHA1 SHA512
        Submit Download

        ~94DE.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~94DE.tmp
        • Size 276B
        • SHA256 c1a1bd9038ec4d9da80cbfea6001e4fd82593cac3722b53594c1ea45a21ef8b7
        • MD5 SHA1 SHA512
        Submit Download

        ~94DE.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~94DE.tmp
        • Size 270B
        • SHA256 677d68b44aee25f998bbeea952726295c63052742c97efc9eb9ab0172f72ea3c
        • MD5 SHA1 SHA512
        Submit Download

        MSI84FF.tmp
        • Path C:\Windows\Installer\MSI84FF.tmp
        • Size 48KB
        • SHA256 cc188b1cac39d8d8a5d1a2195f8e0b9b4fb8d0608fcade43274540f300730cef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSI8667.tmp
        • Path C:\Windows\Installer\MSI8667.tmp
        • Size 212KB
        • SHA256 cff87c98eec91a11f254db00a59c4df32cfad308d74042a2c01eaea079dbd7a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSI8697.tmp
        • Path C:\Windows\Installer\MSI8697.tmp
        • Size 224KB
        • SHA256 c0b50aab3b865dfbfa28b2ccb05641da06c58fcb8e79cc90ffe8a4dfe5ae2b94
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSI8726.tmp
        • Path C:\Windows\Installer\MSI8726.tmp
        • Size 80KB
        • SHA256 1695cbbfb7add4687249c37f180118d89f5c84739fac6901404f3b80d73fa513
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSI8EB1.tmp
        • Path C:\Windows\Installer\MSI8EB1.tmp
        • Size 106KB
        • SHA256 731dfe0007ebafbf110632ee6d9e7f2b36b53f17be5117eab92abbd8b32a9c81
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSI9490.tmp
        • Path C:\Windows\Installer\MSI9490.tmp
        • Size 104KB
        • SHA256 072e4d185482beccf7967dcf10649ee1ea863da61c8336c0215d458b0254977f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        e5780e8.msi
        • Path C:\Windows\Installer\e5780e8.msi
        • Size 21.6MB
        • SHA256 bec4d72a6666cabb27ce6cf539e89b06acece1b2b93830af9da17f9b2eb80dea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/3084-130-0x0000000000400000-0x00000000019A1000-memory.dmp
        Download

        memory/3084-0-0x0000000000400000-0x00000000019A1000-memory.dmp
        Download

        memory/3084-341-0x0000000000400000-0x00000000019A1000-memory.dmp
        Download