General
- Target RECH17321732_9e5ae629d707dac3d5517e7b2c0b05146fe4fdc0_f3e673ac82dd560f7e8de3126a1d027384a77c29.docx
- Size 124KB
- Sample240315-lvvmhafe64
- SHA256 48268799a991b32bb31b6d249931e2530c9095e2df65c4a765ea73c9fba208aa
- MD5 c5849edeea857ba37fe6664a3beaf795
- SHA1 3e0c9a967b321277d718c374d9976a9e68f9a94b
- SHA512 70acf5d69b23bed37f77041babb86155ad9c106f07685f6d1cef648e3556859e0447d1c65da78002508eee1cf9721c4a75e676e4350c653e752e5d96fff5ceda
- SSDEEP 3072:GupUlLYqtRQ8rZuIh/jMV5wAz3aFNMgAEkGyQ:VySqzkIh/jM3aghhQ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
RECH17321732_9e5ae629d707dac3d5517e7b2c0b05146fe4fdc0_f3e673ac82dd560f7e8de3126a1d027384a77c29.docx
Resource
win11-20240221-en
18 signatures
150 seconds
Malware Config
Targets
-
- Target RECH17321732_9e5ae629d707dac3d5517e7b2c0b05146fe4fdc0_f3e673ac82dd560f7e8de3126a1d027384a77c29.docx
- Size 124KB
- SHA256 48268799a991b32bb31b6d249931e2530c9095e2df65c4a765ea73c9fba208aa
- MD5 c5849edeea857ba37fe6664a3beaf795
- SHA1 3e0c9a967b321277d718c374d9976a9e68f9a94b
- SHA512 70acf5d69b23bed37f77041babb86155ad9c106f07685f6d1cef648e3556859e0447d1c65da78002508eee1cf9721c4a75e676e4350c653e752e5d96fff5ceda
- SSDEEP 3072:GupUlLYqtRQ8rZuIh/jMV5wAz3aFNMgAEkGyQ:VySqzkIh/jM3aghhQ
- MD5 SHA1 SHA512 SSDEEP
Score10/10NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
Blocklisted process makes network request
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application