Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-09-2024 13:47
General
-
Target
2f0cbfa0f285df217fac1faad59fa80f.exe
-
Size
27.8MB
-
MD5
2f0cbfa0f285df217fac1faad59fa80f
-
SHA1
bcef79da67710f2691a2f9f1d63815aa58fb8707
-
SHA256
6ec2acc681da0597eeb30a40a34d5d1054152b18eb1e77e9c02a4dc77c030985
-
SHA512
fe0d9fb84afefe2e408d4d0c4d810205b256de729f42d472d7cd503c8070c8888a19581af9e01541b6889eb6d5c83dc3d0ebcabc137c9f43923aedff6c75ae2b
-
SSDEEP
393216:lRPgWrgOSzU6QhcUkTb0LQvz1HaeNceuGznq6HZac4fFrPn:fPgWVOTwkrReeuGu6HUc49r
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f0cbfa0f285df217fac1faad59fa80f.exe"C:\Users\Admin\AppData\Local\Temp\2f0cbfa0f285df217fac1faad59fa80f.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Advanced MMT Video Converter\Videoconverter.exe"C:\Users\Admin\AppData\Local\Programs\Advanced MMT Video Converter\Videoconverter.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x48c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD5b3a213e250ec917c67a1d0e8a6ad9001
SHA194d592dee5a92ea84bc9a02097bd45ed88ba568e
SHA256ef96d0a773f8456cb260fffe238c1153be5859f8ef5a0f2d29a80859874e489d
SHA512fdf56b45c2cf491c2e1e94e03e3575e7cfbddf78f85654eb8039151f0d61158852ec92b9816ffe1746ebff99d3cea98dc35ea6203c4edab333035760a658ce47
-
Filesize
2.8MB
MD56c42393f37c3fe5bd7fe5e9fd8f306bf
SHA11a916c9fa35f96f47028bb86ebecd74e01a8542f
SHA256d8caeef771207bc35e48ce5d7fbc87c7aa16ae8e4a8c0ab32c613736fb258bbd
SHA512374e640322e05abb6c75c7f90a7ed8631723a996c0913bb7c2b0119a5852b0941fd33d9cc1f40f85bbe08edd888f340817ef6e43d92c58317dbc8c9fbb551bf5
-
Filesize
166KB
MD55d9df775b1014d446c751a784a248f90
SHA111ebccab5d0ba8d4403da59f994221134104d58b
SHA256a857e4e1c9b8974cdf3637a5904d20f013b2f21defe51e6d7ccc179b1d267147
SHA512ecadc16a50e6b04772e430a2d40ae3e3da943acd46a8e5ab1ea5df37c565d6a846fe47873fed36f5ca3f65234d98c327ed33b5d0b7605e4f66cdbeee3b238a14
-
Filesize
362KB
MD577db62270b198c2acbc463e3f1f0b982
SHA1ee293fefd9c439b01f4b0584a4816d2ec86221bd
SHA256ecb3c629a4c97d83dce819e0d4b211055be55eff3444cf28a2564b3f0669fcff
SHA51264e153891d1c636b25804404680b13e8a1f3a33cb4c41a92af6363deca7c1d4e779933556a1eb97d55b15a6ba500f102c09e4480cc5b7c91bb284e735afe8132
-
Filesize
1.8MB
MD564539a6e2d5faca1edade6197115578c
SHA1d1bc244de1311abbdb70890514342a6af661ea69
SHA2562f2da6a3d5cfe230f8fe7d254518736e08f4f31491ed4bf137d52c4537a1518a
SHA5120f3287b71553551dda1f8a67e2b3118e51d3981543361f67c0238b711d14e437232b1b85bd40d7a264dba891c8a602055a683a4da3c39a2cbfafe9c80c2d8814
-
Filesize
287KB
MD5fab0f7839e8a70869c288ab9f8622818
SHA11b2d97cd9c58a96820d47fc48356c27ab50d5113
SHA25674968f94677fdf5c39b5dcf1c80a6d0bb03afb8763e253a4a438ac8ed7c937ef
SHA51256629044f242042d9679c63f5860199f67e00a46a952af7430b4edb514da17764699f106717c753fe1f353cdb1d6a80f5ceea648cbc7a192b3568f0b3974f0c0
-
Filesize
330KB
MD5778992626f2bc70be656ee5c09c2a213
SHA168e154ccaa344c1014c1df997c63955fea3ea658
SHA256a7185ae14734de9a194ac6f22aa504c85c1d627b46623e49cd740a0b55fea05b
SHA51265946e0119bfae6c2633eb0ae64a1fd386846a4bcbb475119519bc420d43cee8af9b25c55cf9fcbbd92a92518703129ad69a9454474c0f1e249ccb8d408768ee
-
Filesize
178KB
MD510d431fd5feeb2265a699358bd1271b2
SHA1ed38caa117de507cc236ba32c567350f29be7a1f
SHA25601510d9d759c6c2602ca2891c0f31abdbbef0f3e97b5bf03732facf35944e06c
SHA512efc5cffbdc0c5121c359bf6a0d9e9d66f6c142d66d33a02e0c0ffd39f928c47cc5c995564b3515d00734fec1b7ee529314f6b9d297731a1aa300ba356e6c8387
-
Filesize
355KB
MD5694350e6af2d55c3637fb81dcf21a2d7
SHA1e62b4b56730daef10d02d4b333fbcc42d4512fd0
SHA25619846a0f1d7a661f5e2d36cf6b29337397cef3cf259c97e8898efe26e8ff1862
SHA5129e6565963e27d56ef68f814c095a5b4c06cfd1138c0bb650993f866ab79fa3e6351c4f7b892e3acbd0b0868f547a3ac35949fc26dc1e03288174fcf0c84e7c04
-
Filesize
36KB
MD5a441d73bc5b540f9a75a63730859e7b3
SHA1f30e2aa862d46e7965948373b65c7596cbded283
SHA256dfffca37c8c9638b2c3d90495901af584f7c3621a1867991c36cccf4c4582629
SHA5126dd1e39b696de7db417e2f831cb698786cc25b5467fd5dfcfb7cca181c8e29db429a7205d8bcdc89b4cba93b28b192823a2d51be003c92abd31c21918849d0d3
-
Filesize
96KB
MD5580d5f1c3d871bab51dd606f2a2352e5
SHA198a9744c58e3b9f85e96b591e0f6cd8127f5eeab
SHA25634fbc87d455dc0bffa2866daf2aa2d1b2bc0608623daeec6a80a6702010fe4b5
SHA5126216c4b55621169bbea1edfa633c216ac56287f8eac668f78251fffbb3cd70b250283d76a7a79a0e5ef7d85a4399cd7c9dbb5285cc67b56d6e4f9c0c436c3f73
-
Filesize
670KB
MD51583338f5d055cd5b4ea5677b2ccff6e
SHA12335761bd200d0008cb041eb3d7d4860e9e421e9
SHA256c1f8e9f30a5bf7ca4a0f2f1f60ffd97a0f49f65448bf5b6b4bbdbc8a263a321f
SHA5128a44820050d955d1401ef7b912ac4b86fcf5839fc2a64c1ae4cc8ac1a3fe9bb1aa1fa6063df863d3dc2a1d0804451f6fcac4f188390d5a27a68891273bbed957
-
Filesize
15.0MB
MD52590fa88cdcc28e9ca7b7baf4c048dc8
SHA1441a07436c98a63af66844498b2b2dfa3654644d
SHA256f59a1b07a4f5abfaba7323292b2046c2a5cc3c49fe9e8bcd8cf0a4c6b26fcce1
SHA5129c58836529e015d090e9682acbc05e21b392fe6d8504264e6aed0cff5d0bdcc15cdf551ca561926b531da1b3a71f3e49b9fdf64ffa04a6f6f4d336c778716631
-
Filesize
16.6MB
MD572a8bc7f30b5fa382b736a63a8c0c0a6
SHA1e6b90b5527e3f5b9f244f1de2d15d8d513fddeb8
SHA2560aaa0b6122d416d385e871ce0fa508fa59eec257561ef81ff904415d394b65ce
SHA51223358587a953d59bcd8c632038febfee2a1cd1fb644d5b39ea070ea4e9c727b49b53c40acde1b0e8f2a80b5fd5050dbc6472e53e62f71fbf938ec50fb1c76351
-
Filesize
1.5MB
MD5b3c93b1582f753b36b6087915df7cbd2
SHA1c1a4e89d8131ae9948e91b171a9a5efcc8f21b07
SHA256b3187c70fc77b38806fad063fa5acfb60f9972a67802eeb4a6b517ac84175baf
SHA512b5623d3bcd579e2366696de90502a635707c5ef3d4d3a12bb8d8b17b9879dfa7725f8d63464093d3920329a898b8574b745897108432f5fe053f3dfc517739af
-
Filesize
1.7MB
MD530b33bf10d45c0cdc1c4d874abb39383
SHA1e60059954fd34b27d14dbc8f21e3831a9c3c5f78
SHA256bb9612f4e3818c8682db5ece6263570844bac85583421e1f44a7a82c0363aa96
SHA51274735a052230d8acc06fff4867bd052501aa93fcc7f0ba3bdeb0a1293e9f15f4ecdb50b955ec1ee71980fc52832457cbd259e272c094d2e34836fb0022d94444
-
Filesize
326KB
MD52c33156ea27722fd08575c9ff596466c
SHA186d522e5a115c911a001348ad2fcff02973daa40
SHA256ccdc0a5a0c6e46d6f5991aa0c2a74fa96b6eadfefedde4deef248bc0e05c62bd
SHA5120193437ed87c62ba8a285b1f3a9fb044bba6295cfb83b827336e4c304bd07037ed46c23b291536c8a1a05cc2f1fbe7009dbdaf6a03a195325382c069778cb362
-
Filesize
2.0MB
MD57573903d85593e097cb3be1a1d1572c2
SHA15f97f22da6e345f98bc84db84024dcb14bfb24ba
SHA256b89c53f9ada2da742d329e765999724541df858d6972c1deeaf0dd7154c1deb5
SHA5121d42c0717cfdd31fe64a8cb302d472eb59946629d71948308d4ac9b69df7eb2224d64c427cf95f30612f109b9fdf496faa8722cc5c37d682d11db0022dc59ad9
-
Filesize
2.2MB
MD537ef9a0e82727d2265d67a9e927e5b8d
SHA136d20a0ea50ebacc13e9902735053f2069898b34
SHA2561c749b0bea993169a8f9c14cef97339114150a4f25ca51ea2e1a89ebb755e6df
SHA512249419a143a7a816ad63c991b14d9c06b17b8ef9dc256a6befee9565b2e2ad79b41bb46ed2f2e7f8c46fe8137b8b0a28836c6a2c6423d9fbd8e204b3202077de
-
Filesize
2.5MB
MD557512ce8d50ff06234b056179a71586a
SHA164eda393a2bef9884457d4ff30d15b6dfe6f92f4
SHA256b0159c453d988c0a392f01bd57295e575f5352bc3abd17e707f6a267d53a03c8
SHA512c386ef0bc389c9ba36aa0c46074880cff39d6fe5f80bdf67fe673a0e09c2b8615bcf41f8b41febe9f22edc65388e5579265bc395be4920b3d579ae8bf9b5664d
-
Filesize
580KB
MD55ee2a64aa58b599bc4fefd560a8eeba7
SHA10053baab59b92bc4fab54aae4eac272438080526
SHA2561f131e86a97e54b102d9be1cb6680a8a4eaf627d518861032346210dd227ead8
SHA512e0d6c0053febb0d45da9ab3566f7768ed225792905bd71fdae65c892e977cc6cfe59881d4fb16e1d8cde68dc493c63875dde6478ba2cb163085211329c598491
-
Filesize
261B
MD5886e4bb84e1ecc4a04ae599d76fcce1d
SHA13f0493bb2088af50bcc8223462db0b207354e946
SHA2565eeb014e3b390e0c85ce72988d422dcd9de1520566b11755c70bdd9bb7376060
SHA512f4db9038a113c4b1e2462b3e0becef2500c9532a79c8187f51d011d690bc68c6d1a99585e43136cb082bd6a232136546db50265f226ff19e67d8430306a8761f
-
Filesize
185KB
MD54be7d715efc9aa8e484cfed90cb355f7
SHA1a0a42d3fe952ca4cb35bd36d4fa861da09cf5220
SHA25673c1ea9c103214ffef68252b0fa50a9394a7026c230c4660ea8a6d02f08add6f
SHA512fa836aa7471928531f2f1bd27b75152b044a018eb1b42f5751b734aa5237b1e4a16ecf2f84c9134a99c4c9778a4f5f6b7daedd003207e3a93b094caa9624164a
-
Filesize
68KB
MD56f346d712c867cf942d6b599adb61081
SHA124d942dfc2d0c7256c50b80204bb30f0d98b887a
SHA25672e6c8dd77fa7e10a7b05ef6c3e21d3f7e4147301b0bf6e416b2d33d4e19a9c3
SHA5121f95a211d5dd3e58d4e2682f6bf2c5380b230e9907e2882097b77b99520cd2c788f43ad2abcce617dd8ded0043e4ef1c8b6e083c44688b23109868e6cdd2364c
-
Filesize
44KB
MD554aeddc619eed2faeee9533d58f778b9
SHA1ca9d723b87e0c688450b34f2a606c957391fbbf4
SHA256ee15e6e3f82c48461eb638c1ea11019ae9e3e303e067e879115c6272139026e7
SHA5127cec39f32804109b3d502027d1ec42a594c1e4a2d93512195c60bd41aad7e32a8b0eb21a0ee859fecb403ee939eebc4608d9d27a4002b8c282de32f696136506
-
Filesize
308KB
MD5478bfd5a1d918a32eb2b48d08c60f3b0
SHA19d0650083a2545f3f0f711259407c2d7425663fd
SHA256cf929e03f373d0dfe0e378778eaa2dd048d01c3a998ee8475c93da90d6887854
SHA5121e216e8dd4aa6b9ac47ccf4ea70eebcee2190376bf8a0e5ef740cc8a922adc01bf6dc7b62aeb1024b8b48cf546fa9750cb2b03d586f16cc1f18bfe9cb10c2b00
-
Filesize
101KB
MD5933daac76271c5b6e73f2f317227d40a
SHA129849e5bb80da373fd4aeb4848fcfd044f0285c1
SHA25693ca5a7683524b927fe444ff8535c1483466905d0127b816af5c38105c7b867f
SHA51239da5e5e6f360104aca489f8e3d184af5a8f993e012e62c62104e03d717d15af32de82a8b79cf588f68a9f3854affc8173244cf71f00d8cedf9da00269497705
-
Filesize
491KB
MD5a77eba780a25aee9bc8bcfacd933ca2e
SHA1892ff855046f66febb144c3ef7b0bb661c43c9c8
SHA256a5716f6546c98778436fea455eb35b7cf8fae0f380bdfa2053201a75afa6e8d4
SHA5120c44d284c968b406664a7b20c77202da78c79600d23b6813842e091cd163ea2e4da7b1a54d252a5ca9eec70401729cd9ad75fbe03d2848cefba650dc9709313d
-
Filesize
772KB
MD54962d3bb23aaa3b389f986335e6c4ee2
SHA11b01a8f626a0cbaea18622cd4dcfb3c0cc632ad8
SHA256c205df696f37d6c6aa0832f2b776b2e461665ffb5588a7ab7d35bcf24be4506d
SHA51238f1fbc8a35d481fc7b12d85fea29a228e5a5918cbee6c18b90ca8c1e43a295088e28fabe1d5ed832821caf1e2b6fa573759819d2232455d9ee163f706b91143
-
Filesize
46KB
MD58b8c7e3971e51920409c76b4c353b3bc
SHA13c23b45fff9a28cbbbaefeb09395b844defe976a
SHA256582959691dfef4821b7547fde23b7c0177bc4dfe64321481987d37ee682c4a95
SHA512698bc762c4768a252fa7d6f191d55ed6f23c360fe4e6d3989226213a1a0fca0e588a36ae53b5039cd88340fba1a7394f993124308c477b5519a2dc6807a0058d
-
Filesize
16KB
MD5c115c03302483c420f586659ea1bb286
SHA1a94ff78fb458ffd68f2289aa7ca230180716f1af
SHA2563e4ed5912bb7a61be93172451fc1af2cd7acd98c16dc80c616ade26e01d25ab4
SHA5122f6f52a4f7b9a39fd74d2df3d8ba05185c8122465ce2fd862d3d6dd63fe8aafb58f4cc031b36cb24da5e787ed71e49adb519a946cba1250345d39249801668e6
-
Filesize
364KB
-
Filesize
1.7MB
-
Filesize
4.1MB
-
Filesize
2.0MB
-
Filesize
704KB
-
Filesize
324KB
-
Filesize
596KB
-
Filesize
4.0MB
-
Filesize
1.1MB
-
Filesize
48KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
44KB
-
Filesize
15.0MB
-
Filesize
1.1MB
-
Filesize
2.0MB
-
Filesize
23.7MB
-
Filesize
704KB
-
Filesize
556KB
-
Filesize
140KB
-
Filesize
220KB
-
Filesize
1.6MB
-
Filesize
424KB
-
Filesize
15.0MB
-
Filesize
15.0MB
-
Filesize
1.3MB
-
Filesize
320KB