Analysis
-
max time kernel
767s -
max time network
888s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
19-09-2024 01:56
General
-
Target
concur/concur.exe
-
Size
54KB
-
MD5
074ea94236b4f9ec54949fda9335fb6d
-
SHA1
4400aa631cb9f574bb21bf2d7610f7bfb1271946
-
SHA256
4140a3aa5fc739a37f45b2c307decf5aa9ff9bcc33b4365e878c64e1e252dfff
-
SHA512
a82c3d23365909e9a320c6b1127e1c15e0fc528e543872c360546bfa2ba78e6a9d31200bff9aa7570eb857dfb3baccb51805a7879caded05a7bf6a9aae3a80d8
-
SSDEEP
1536:HtvrImfzoXK6DDvvvDvpvZMt+pan/opgJS2:lImfzoXK9/o6N
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\concur\concur.exe"C:\Users\Admin\AppData\Local\Temp\concur\concur.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow