Analysis
- max time kernel
148s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
16/09/2024, 11:11
General
- Target 2f0cbfa0f285df217fac1faad59fa80f.exe
- Size 27.8MB
- Sample240916-m99kmsthkd
- SHA256 6ec2acc681da0597eeb30a40a34d5d1054152b18eb1e77e9c02a4dc77c030985
Malware Config
Signatures
- NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f0cbfa0f285df217fac1faad59fa80f.exe"C:\Users\Admin\AppData\Local\Temp\2f0cbfa0f285df217fac1faad59fa80f.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Advanced MMT Video Converter\Videoconverter.exe"C:\Users\Admin\AppData\Local\Programs\Advanced MMT Video Converter\Videoconverter.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2d4 0x3081⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
AVKernel.dll
AVplayer.dll
ApngDecoder.dll
HWEnDecoder.dll
MediaEncoderImp.dll
MediaJoinKernel.dll
MemFlash.dll
Pic2M2V.dll
RealQuickJoin.dll
Verify.dll
Videoconverter.exe
avcodec-55.dll
avfilter-4.dll
avformat-55.dll
avutil-52.dll
gsUpgrade.dll
jconsume.dll
libx265.dll
magicskin.dll
nsm.lic
postproc-52.dll
pthreadGC2.dll
pthreadVC2.dll
simage.dll
swresample-0.dll
swscale-2.dll
xvidcore.dll
VideoConverter.txt
s2qk.2
memory/4472-200-0x0000000000400000-0x00000000012FF000-memory.dmp
memory/4472-204-0x0000000074C30000-0x0000000074DBD000-memory.dmp
memory/4472-151-0x0000000002770000-0x00000000027C0000-memory.dmp
memory/4472-145-0x00000000026F0000-0x00000000026FB000-memory.dmp
memory/4472-140-0x0000000001D70000-0x0000000001E20000-memory.dmp
memory/4472-137-0x0000000001E20000-0x0000000001EB5000-memory.dmp
memory/4472-131-0x0000000001940000-0x0000000001D5A000-memory.dmp
memory/4472-128-0x00000000018C0000-0x0000000001922000-memory.dmp
memory/4472-142-0x0000000001ED0000-0x00000000022D7000-memory.dmp
memory/4472-174-0x0000000008840000-0x0000000008999000-memory.dmp
memory/4472-195-0x0000000008840000-0x0000000008999000-memory.dmp
memory/4472-197-0x0000000008840000-0x0000000008999000-memory.dmp
memory/4472-202-0x0000000074E50000-0x0000000075009000-memory.dmp
memory/4472-162-0x00000000027C0000-0x00000000029C5000-memory.dmp
memory/4472-147-0x0000000002700000-0x0000000002751000-memory.dmp
memory/4472-210-0x0000000001D70000-0x0000000001E20000-memory.dmp
memory/4472-209-0x0000000062600000-0x0000000062726000-memory.dmp
memory/4472-208-0x0000000073170000-0x00000000731A7000-memory.dmp
memory/4472-205-0x0000000074C00000-0x0000000074C23000-memory.dmp
memory/4472-211-0x00000000027C0000-0x00000000029C5000-memory.dmp
memory/4472-203-0x0000000074DC0000-0x0000000074E4B000-memory.dmp
memory/4472-201-0x0000000075010000-0x000000007507A000-memory.dmp
memory/4472-207-0x00000000731C0000-0x0000000074974000-memory.dmp
memory/4472-212-0x0000000000400000-0x00000000012FF000-memory.dmp
memory/4472-385-0x0000000000400000-0x00000000012FF000-memory.dmp
memory/4472-397-0x0000000008840000-0x0000000008999000-memory.dmp
memory/4472-411-0x0000000008840000-0x0000000008999000-memory.dmp
memory/4472-167-0x0000000071ED0000-0x0000000071FE4000-memory.dmp
memory/4472-507-0x0000000071ED0000-0x0000000071FE4000-memory.dmp