Analysis
-
max time kernel
603s -
max time network
1191s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
24-06-2024 01:37
General
-
Target
User/client32.exe
-
Size
54KB
-
MD5
0390d6c23eb9001759fc654ad8b91a1d
-
SHA1
30a485118e69f66c0dce1d656b5b366f62eb638c
-
SHA256
1dfc715e9f4c9d0dd16b23f9d4d289aa9961b1781273aef11721a8543f348711
-
SHA512
dadfa7656d070e724319303f8b9c67a5fc8d64f0e4ecc460c03ac0bad9aee9c5f3e5dc5859f665a3a7ad3d2b783755eb5b89a04f824c6ec0629405d428cc35a9
-
SSDEEP
1536:HtvrImfzoXK6DDvvvDvpvZMt+pan/opgtg2:lImfzoXK9/o6D
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\User\client32.exe"C:\Users\Admin\AppData\Local\Temp\User\client32.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow