Overview

overview

10

Static

static

7

7831c04056...62.exe

windows10-2004-x64

10

7831c04056...62.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    276s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240214-en
  • resource tags

    arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21/02/2024, 00:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62.exe
  • Size 20.6MB
  • Sample240221-af4q3sge3w
  • SHA256 7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
netsupportpersistenceratupx

Malware Config

Signatures

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 43 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 40 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 24 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 31 IoCs
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62.exe
    "C:\Users\Admin\AppData\Local\Temp\7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\762A.tmp\Install.bat" "
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2164
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\762A.tmp\ns.msi" /qn /quiet /promptrestart
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4156
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\SYSTEM\ControlSet001\services\Client32 /f /v DisplayName /t REG_SZ /d "PCHelper ôñá½Ñ¡¡δ⌐ »«¼«Θ¡¿¬"
        3⤵
        • Modifies registry key
        PID:4084
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4984
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B7EB65C8BAA2DC2F12610BBD471423D5
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:4048
    • C:\Windows\system32\cmd.exe
      cmd.exe /c ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{64893459-B4B8-403D-8E2D-8395D2BA3F1F}\\nsm.lic"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4120
      • C:\Windows\SysWOW64\attrib.exe
        ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{64893459-B4B8-403D-8E2D-8395D2BA3F1F}\\nsm.lic"
        3⤵
        • Views/modifies file attributes
        PID:4964
    • C:\Windows\Installer\MSI8914.tmp
      "C:\Windows\Installer\MSI8914.tmp" NSConnSvrUI.exe NSN
      2⤵
      • Executes dropped EXE
      PID:4944
    • C:\Windows\Installer\MSI8953.tmp
      "C:\Windows\Installer\MSI8953.tmp" NewShortcut1_DC174CC2D1F545EBA5FA9A05CD201FFD.exe NSN
      2⤵
      • Executes dropped EXE
      PID:3884
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 711EF167F0CB498AFB74BC404B1D68E4 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      PID:1696
    • C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\checkdvd.exe
      "C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\checkdvd.exe"
      2⤵
      • Executes dropped EXE
      PID:1496
    • C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\WINSTALL.EXE
      "C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\WINSTALL.EXE" /EV"NetSupport School" /EF".\Log Files" /EF".\Bookmarks" /EF".\Tests" /EF".\Store" /EF".\inv" /EA /EX /EC /Q /V /Q /I *
      2⤵
      • Sets service image path in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1356
      • C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\winst64.exe
        winst64.exe /q /q /i
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Registers COM server for autorun
        • Drops file in System32 directory
        • Modifies registry class
        PID:5112
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 6D10E655D6C73E7CCFE74C1935BAF3E0 M Global\MSI0000
      2⤵
      • Modifies registry class
      PID:2980
    • C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\WINSTALL.EXE
      "C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\WINSTALL.EXE" /EI
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2232
  • C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32.exe
    "C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32.exe" /* *
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3076
    • C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32.exe
      "C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32.exe" * /VistaUI
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:3480
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
    • Modifies data under HKEY_USERS
    PID:4844

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e577a73.rbs
        • Path C:\Config.Msi\e577a73.rbs
        • Size 40KB
        • SHA256 b0e767cab9f3ed00179ce749d86cb1305ff989997cfdb10de0d243b350d57ca7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SHFOLDER.dll
        • Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\SHFOLDER.dll
        • Size 28KB
        • SHA256 3419e795ff8ae1e2c188a45b9a31c77a7fb15a45684fcbe70c220945c63422c7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WINSTALL.EXE
        • Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\WINSTALL.EXE
        • Size 637KB
        • SHA256 01b4a00bf69b151e4dbedc5273739388fe59697477d5848219a5f54cafe7faf1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        checkdvd.exe
        • Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\checkdvd.exe
        • Size 396KB
        • SHA256 a51fa80689ca5af9ee74995a8e6c6f0b3b63b21b8eea53981836cbda4dcdc736
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        client32provider.dll
        • Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32provider.dll
        • Size 82KB
        • SHA256 ac455c89a8c167cf6552613a7adfc66f62ad15c35f6ebeb5c32fe8565c68d72c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nskbfltr.sys
        • Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\nskbfltr.sys
        • Size 33KB
        • SHA256 e7e628de2ed025ad146328e86fa7ab83a79962972cc847263f984edc567d6e7c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pcimsg.dll
        • Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\pcimsg.dll
        • Size 37KB
        • SHA256 cc905356821f51db8e4ee2ec96f44b28cbc1f817cb6f147b0abef41233280d42
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        product.dat
        • Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\product.dat
        • Size 506B
        • SHA256 065d817596d710d5a06060241acc207b82b844530cc56ff842ff53d8ff92a075
        • MD5 SHA1 SHA512
        Submit Download

        winst64.exe
        • Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\winst64.exe
        • Size 127KB
        • SHA256 15d7d3c8cd9654fc6e52cd77d674bced7b57c9710f4e615fe8630fd2282d3618
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Client32.ini
        • Path C:\Users\Admin\AppData\Local\Temp\762A.tmp\Client32.ini
        • Size 1KB
        • SHA256 153dc072bc02d29f33e826a9116ee13094dc87eb83956aa48bd604a8d9aa3d7c
        • MD5 SHA1 SHA512
        Submit Download

        Install.bat
        • Path C:\Users\Admin\AppData\Local\Temp\762A.tmp\Install.bat
        • Size 312B
        • SHA256 cacd72fe9928925d9e2f08d0e551ce63c2415d31e3987e90a727841f7d8ea791
        • MD5 SHA1 SHA512
        Submit Download

        NSM.ini
        • Path C:\Users\Admin\AppData\Local\Temp\762A.tmp\NSM.ini
        • Size 69B
        • SHA256 011c851c57cbec1d827b3d129c6786d60bbf82460254a4a5b2ad292ab83c9b22
        • MD5 SHA1 SHA512
        Submit Download

        NSM.lic
        • Path C:\Users\Admin\AppData\Local\Temp\762A.tmp\NSM.lic
        • Size 255B
        • SHA256 61cfdefd60d4839a8d38b4e2483f68c26b7e2b8dbbe697e75679b7f03b292b67
        • MD5 SHA1 SHA512
        Submit Download

        ns.msi
        • Path C:\Users\Admin\AppData\Local\Temp\762A.tmp\ns.msi
        • Size 21.6MB
        • SHA256 bec4d72a6666cabb27ce6cf539e89b06acece1b2b93830af9da17f9b2eb80dea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DLL_{64893459-B4B8-403D-8E2D-8395D2BA3F1F}.ini
        • Path C:\Users\Admin\AppData\Local\Temp\DLL_{64893459-B4B8-403D-8E2D-8395D2BA3F1F}.ini
        • Size 1KB
        • SHA256 1a10ebc520ef28665496adda8f331c0a75773459afc743e3d7a9944070d3e0f9
        • MD5 SHA1 SHA512
        Submit Download

        Client32.upd
        • Path C:\Users\Admin\AppData\Local\Temp\{64893459-B4B8-403D-8E2D-8395D2BA3F1F}\Client32.upd
        • Size 25B
        • SHA256 00e0c629d5645c15df66adcf99e8a0a3e517d7a7876141ae7a752f0585eec047
        • MD5 SHA1 SHA512
        Submit Download

        NSM.LIC
        • Path C:\Users\Admin\AppData\Local\Temp\{64893459-B4B8-403D-8E2D-8395D2BA3F1F}\NSM.LIC
        • Size 255B
        • SHA256 64c45c70743b974f63e8d85ffa30cc96d9788e3bad730fd96d9bf8068777eb5c
        • MD5 SHA1 SHA512
        Submit Download

        ~8A01.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~8A01.tmp
        • Size 276B
        • SHA256 c1a1bd9038ec4d9da80cbfea6001e4fd82593cac3722b53594c1ea45a21ef8b7
        • MD5 SHA1 SHA512
        Submit Download

        ~8A01.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~8A01.tmp
        • Size 270B
        • SHA256 677d68b44aee25f998bbeea952726295c63052742c97efc9eb9ab0172f72ea3c
        • MD5 SHA1 SHA512
        Submit Download

        ~8A01.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~8A01.tmp
        • Size 281B
        • SHA256 82999a16b37cc6bba663fae8e963c3888a6dee162adf8d074edd5d579cb8bf65
        • MD5 SHA1 SHA512
        Submit Download

        MSI8453.tmp
        • Path C:\Windows\Installer\MSI8453.tmp
        • Size 48KB
        • SHA256 cc188b1cac39d8d8a5d1a2195f8e0b9b4fb8d0608fcade43274540f300730cef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSI8500.tmp
        • Path C:\Windows\Installer\MSI8500.tmp
        • Size 212KB
        • SHA256 cff87c98eec91a11f254db00a59c4df32cfad308d74042a2c01eaea079dbd7a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSI8521.tmp
        • Path C:\Windows\Installer\MSI8521.tmp
        • Size 224KB
        • SHA256 c0b50aab3b865dfbfa28b2ccb05641da06c58fcb8e79cc90ffe8a4dfe5ae2b94
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSI8522.tmp
        • Path C:\Windows\Installer\MSI8522.tmp
        • Size 80KB
        • SHA256 1695cbbfb7add4687249c37f180118d89f5c84739fac6901404f3b80d73fa513
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSI8914.tmp
        • Path C:\Windows\Installer\MSI8914.tmp
        • Size 106KB
        • SHA256 731dfe0007ebafbf110632ee6d9e7f2b36b53f17be5117eab92abbd8b32a9c81
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSI8A01.tmp
        • Path C:\Windows\Installer\MSI8A01.tmp
        • Size 104KB
        • SHA256 072e4d185482beccf7967dcf10649ee1ea863da61c8336c0215d458b0254977f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        e577a70.msi
        • Path C:\Windows\Installer\e577a70.msi
        • Size 832KB
        • SHA256 f0be52fd3d3125c1e577e1a7c857f42d5fe54d97bbead0de5edfe40a951ad5b2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1984-0-0x0000000000400000-0x00000000019A1000-memory.dmp
        Download

        memory/1984-320-0x0000000000400000-0x00000000019A1000-memory.dmp
        Download

        memory/1984-343-0x0000000000400000-0x00000000019A1000-memory.dmp
        Download