Resubmissions

15/03/2024, 09:51

240315-lvvmhafe6410

15/03/2024, 09:26

240315-leabmach3w10

General

  • Target
    RECH17321732_9e5ae629d707dac3d5517e7b2c0b05146fe4fdc0_f3e673ac82dd560f7e8de3126a1d027384a77c29.docx
  • Size 124KB
  • Sample240315-lvvmhafe64
  • SHA256 48268799a991b32bb31b6d249931e2530c9095e2df65c4a765ea73c9fba208aa
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Targets

    • Target
      RECH17321732_9e5ae629d707dac3d5517e7b2c0b05146fe4fdc0_f3e673ac82dd560f7e8de3126a1d027384a77c29.docx
    • Size 124KB
    • SHA256 48268799a991b32bb31b6d249931e2530c9095e2df65c4a765ea73c9fba208aa
    • MD5 SHA1 SHA512 SSDEEP
    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks