Analysis
-
max time kernel
121s -
max time network
110s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
19-09-2024 12:26
General
-
Target
ea34bd669623b802574b8da23549a66227b7aea5480e80289ec8b2ff6dc5cd7e.exe
-
Size
6.2MB
-
MD5
f30257ceae9a67d36a4e62f20ca7da00
-
SHA1
e3ca7a72b61fac410b406163ecc299b89f01224a
-
SHA256
ea34bd669623b802574b8da23549a66227b7aea5480e80289ec8b2ff6dc5cd7e
-
SHA512
f301745a2474911510066eb58178a804c1aedff3f40102b1ecd6078dd87ee59f12dd6217c23481c1ef78ab625079e1a733ae70d7de470a321802a5f0afcf378b
-
SSDEEP
98304:Cwi471aEj6tOKNnwp2QNNVNDP+f4GXpcNB6wijexMRq:I4AErp2oWj5fjexb
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea34bd669623b802574b8da23549a66227b7aea5480e80289ec8b2ff6dc5cd7e.exe"C:\Users\Admin\AppData\Local\Temp\ea34bd669623b802574b8da23549a66227b7aea5480e80289ec8b2ff6dc5cd7e.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\TS Recovery Module\TSConverter.exe"C:\Users\Admin\AppData\Local\Programs\TS Recovery Module\TSConverter.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
445KB
MD551cebffde43c239da5e69b0e64954522
SHA1a2f4bc0f6a7b49ea3902d654a953b3cc2239e6c1
SHA256ceaa4c00412760b2f15c241f2d7b57bc4744c15d3d1157d9d2a9693d2ee84318
SHA512e0d641e7ad666115f50dff0a304b8f3fa03f2d86f64ad38159c86bd3724682d12b3f5cdbe06ddebefa00e6d3abc5a4a0519170b6029c959ed93a8255935f7ae6
-
Filesize
444KB
MD5a883c95684eff25e71c3b644912c73a5
SHA13f541023690680d002a22f64153ea4e000e5561b
SHA256d672fb07a05fb53cc821da0fde823fdfd46071854fe8c6c5ea83d7450b978ecb
SHA5125a47c138d50690828303b1a01b28e6ef67cfe48215d16ed8a70f2bc8dbb4a73a42c37d02ccae416dc5bd12b7ed14ff692369bc294259b46dbf02dc1073f0cb52
-
Filesize
4.5MB
MD5678c947dec2979c843f8cdd24796ef46
SHA1f5f8f41e6480f9b42344241b76e8e384adb6b9a0
SHA2560b407af1ed1a77ffd7503ed396a1091e41e0ae6865204d3e38dc6af147a1dbf2
SHA512e34583d7cfe5b555d59218b019469171c02e2a193e74f9cb587a24e0abd82969102bdf0c4a06929f1c13602d613b43f653b58c233e7edbd5d1d4c5db2a707055
-
Filesize
4.3MB
MD526110086dd51fe3b5c864e0e3578aefc
SHA13be4e4f87f5dfdb58e0cfd9b7745de3e48d45df4
SHA25664d2a7dae905617df9833118247c10de51352aa48dd9c72ae5c223f3ed54b4b4
SHA512a852e740d7a0cf41bc6329a259c3a2ced80f9d3654b3e23bc5b9c0eb93552a26850d7ebcc824c7648550d1b5d7bdc6c8809d0bbb1c68a4856669fadf5e48aceb
-
Filesize
1.3MB
MD55a6f456d255b03be9343edffe8c520bf
SHA1db1f3c9997a54997053f76c5f46a437915ce30ab
SHA256df5100c87689e2dee348c7f3976a8e0c22c6b0a2ae08771d2ea636f9233982c7
SHA5122452f5e12be7c8eca332a49dfd1363b921892486a70d387cf01e7f94679b2eaa9501019e081ac76c92bf77afd9511a59a8be1d810d030f63eb720e7ed6b4032f
-
Filesize
184KB
MD5f6f5488c05f0c4a347d927bd10f6b36e
SHA1b889342b7d64d53dc08773c3653ea494f1eca08b
SHA2569f30e1d9f9f18f57b06a447f825e7483dc1ccdec7ae4440e50afd00b9e820be9
SHA512f4d41b1323916e95b9e76ce220e66710f380d5806f4d47f9a4fab2e94f78980106c88955ea8ce1a713a43e95ae4aca5fda792ce91931d733049a610e4a65f945
-
Filesize
29KB
MD5effab3ddc3d33491f066903c4c95d361
SHA19be3bf66f3b8990fa919b5459b564a34ab81aaeb
SHA256fddaecd2bd619e12fc2916e196592488090d558a9668429f570582b0ea557028
SHA5128a569acd8fa384e1b529b7d63041d247e88cc15ef0477b457a7ed6d43a21b13e814193085224f67233c554b9d5e8aa598504fc3d3c1dd9650e69784d20d4d993
-
Filesize
19.0MB
MD5d252bad2bb26a0b1b7cb46ac36394a65
SHA14185c56dd7408df6ad1a10cd94905af1c06a3ecc
SHA256484cf9310f35f79f83ba5327e20909420d0cea286ed0ea8fa5755bd5f2b00ce3
SHA51266e8eb94097932460f4df82d56ea00807b89e0ea78806d5618daa2a3521b5a343162b42ea68cf491114708d86aab018a0df4486793c31fee7e150a97c8a7ea20
-
Filesize
1.2MB
MD54dc29ce2b9ee297a6a1f4f8ac04b8acb
SHA157253632652dd8f04a8726d7fc5bc0dab515392a
SHA256a2c74d26143fa42ff496776959ed6ee1eba5bd64f97089fcff674a11a51a6d67
SHA512afb1f72451e0d19001be410b84c0437cd3aec6b1524895661e07f41ecca9fb763bf3c677538b416a36fd57bf779f49a824c6a7d0a9540f5a0a38b40e6a786a4d
-
Filesize
410KB
MD59c200ca1d22c6b82a172e715cc82d526
SHA19aa93fb66d6d4c06595c24348748d70c3211843a
SHA256ca176820ec3ff40076f1c4977c81d2ef7e3165a6674187e4175f34fb3926c77c
SHA512a30f4ff1f71db7c21c4a6a1ab7c956c98d82ceb02ca93639649678aa24f3ad08641ac30a0f7c19d3e9d8c38857bf368002ca78e4fb7ceb26db21d23a9cdfba45
-
Filesize
673KB
MD5ff3f9fcb6dac5ed607008a117dfcbcb5
SHA1d53a919936575147681e6d86808e04346fd67a95
SHA2561f01405fcd4c108862159469da98010346db94de971053132a515252caa95a4d
SHA512ad30496099ca5901e327beb3b1ffa493c9ee8210c559285b344bd506f4624aca3ec4193de36f4da45246be1917d388698574a6fc0baa9d38e374cf89a6dc5177
-
Filesize
261B
MD5886e4bb84e1ecc4a04ae599d76fcce1d
SHA13f0493bb2088af50bcc8223462db0b207354e946
SHA2565eeb014e3b390e0c85ce72988d422dcd9de1520566b11755c70bdd9bb7376060
SHA512f4db9038a113c4b1e2462b3e0becef2500c9532a79c8187f51d011d690bc68c6d1a99585e43136cb082bd6a232136546db50265f226ff19e67d8430306a8761f
-
Filesize
997KB
MD5382166cd2b5ceeba4237104f9b0c0e14
SHA1d5fbfe37c92f8016334faceb2e2e219871b4d431
SHA256c24bb651c1ab40f3afe045ce15b613f8b481795957b77387f9ce3bad1e4377b9
SHA512b60e1ea7b397a9d2fc2123cdb815c58c2573dfacb4386ec213fce3052e94cc63871c63b959ef6168ae9ad7e10bd21987fff5a4008e01ee00e8466c3e9acf8ce0
-
Filesize
16KB
MD5cf86cf6a13ca24d62b4f9c04f9bf72b2
SHA1223f82873b50fc09a0a3083997c01c24d937b1aa
SHA256d9a57ef170aa6ab550fa062a1c14992785d88c8146dd512e13b415f80463770d
SHA512380a05313aed9e6695cb7400133c2df317e5b811b89cb47d16bcba96cab28a5663b0db77b8c7a78f88f5b417bb83958022d91ec73adceb24acfa30858c016c4a
-
Filesize
16KB
MD5844b715871799204bd2fc84227d83971
SHA18561af323047a0c56c363bdf284e902730dc5f29
SHA25613953bb4df88650c989f41b17586f7c24c5ec2b17226118b6425b096c30bfdae
SHA51265d768e7e449ab674d3277244c39843b5b3ad918cb4e64d61627f74255d13d1a2c54c8c05a1ccb6d52ccbbc3db156ec460d9d351400f9c4567afc4f6bf11dfbd
-
Filesize
16KB
MD5b3f86bb6df744e8e085c048467314d8e
SHA1fa64d4be9363a6e3e1b8a41e400e158e5daa5c2a
SHA25674291468a25f8d4a58f7c82b9e47d745f1b4b5a9aa73cd5310cf4b46f0abd2a6
SHA512dd3763195bd3d4c6109fc6b2c735b5da3b277212b41c8036a942c8434e48015f01c1574ad9c1d7756197c38ae2a6f3d1eb8074289234f6d339c078b5896798cf
-
Filesize
213KB
MD58b0f978c7615eab0fc9b0bb6d60b3edc
SHA15f6116f0fdf43f40933e909597d1d263cb0da348
SHA256c10eba110d341c2d3a52bbca670d47d2a8a586b0ac09150b7b639e22885e79be
SHA5122756c2f509680a5e0e8316dcfe201a74ba61efedb9e15aba790edc1fa792cb133e3b8197112b625a623c6bbc59953808953c2b2e55e22f673a3aef8b8fe0b308
-
Filesize
111KB
MD575a2af2dea3da4e77bfe3939ce779fa8
SHA14cd02b95ca14d23947f578de1473b939117f4303
SHA2569e2d384fb2b7c0d044400729f1f7b85284f62497b2db619059fc16aa76077027
SHA512a74be65b74822fa3baad9d424b81ea164f1bad39ed15695ee8b90b352b3cbe8e264391f004622af45294abdda045df97835dbfafe67ae831954896944f2e116d
-
Filesize
63KB
MD5494aca51661c838a2e6b6035aa3dc8e3
SHA10456add0c5a4617bf6a0a8973fc4faadeb399021
SHA25679fc5eed59b3ce4d97490074c0d189aeb721fa5e84c503371f4b665de7fab609
SHA5121818f1be75eedd7cc9782454313c2b23bd8d9c76cc954af7ce1a96ce0688632a3ba933a5da85e54efc7d0d900b884d32b122b6215ecef5a423cffdadd644cebf
-
Filesize
334KB
MD57a99eacb3808e194ec874c66fc86a603
SHA17383c7cf256a461f2747ce9f72dfb172904a8090
SHA256dcad80572bc2336cddd99d9abc432d241554dd0b694b36f5031be5a993232b88
SHA512273b977cc56c01149f13592c31f6b6595825cce41ef5bcc501aec6d8758bc446294d961ca24ac6a2a61c2c43490f8348dfd6c6ae5c166a236b634d501ea3a3f2
-
Filesize
1.0MB
MD597638522de02899961efa883e48af48a
SHA17921f7c4b0a4fdf8d78a66d3ab0bbd445f59ea9f
SHA256db00ca4f3b8e9b127b28921d88ed5efcaec342bef510367556fc15c81e6f99e2
SHA512a7d5c538a157a145110708a3d374ff11d64b781942b3a87891cdfd834baff04ccb29da4705ac79f741f1c29041703f4568d57a5161025457d93f66f2059b4740
-
Filesize
242KB
MD5362be76a3f8c15111aaeb3e2316a2ade
SHA1b544dd53e8a16e7d257ed8c9070af57647c395a5
SHA25676ecf30a1a83d49fb710f4b808884a285f82e9242a81228beeb767848d6ead44
SHA512eab608c54b2ea32a0fa197157ab65e79beb2a6e030c018db13b6e2a0f338ad26842a9ea2258e5f43387a8c9e5fbf2f1e54fb7ab15b1d82d23362382a4555f7e2
-
Filesize
1013KB
MD5d224e12162e977ede4fe2d07380c5b22
SHA13b8ae72d45c544efe4dda03c5aa6443eda4e1279
SHA256fdef4926120a2f5bf25256c7a0300e203e476e60a29c333e73b2dba515465035
SHA5126c103264bbd597000201654843857d48408c6e36350b779fc283774e4b38d0e04ae1b62ac95bb3154ea7c7371c03302beedbfcfb3fc37f55ad7cabe8aec19cca
-
Filesize
4.8MB
MD56d77fd2afc773f604380e34172f313d6
SHA18c938f8000e262746eae7ef9fbb813eb2302e674
SHA256f719214250d7b36bfddfd78b2d094500f025a8d50d0e297d9c29927e65a4aeca
SHA5128ae8153d5d69ab9596f9ca572f75d817cc9a7b2005915b438e4448114d05ffa4b6ac0426ecfd6cdbbda26461a766a1ca58b0cd7f8d0ef09c5d3a91c19547fed1
-
Filesize
844KB
MD511a576944c9aaadcd9deb12dfc173bd7
SHA1ac08ddd705859529241310abfea6280f5554306b
SHA256fce717eecf407cafdf6a30f33246e3244a568ef06d9077823695d014c79f910c
SHA5125fde256826f8e5a4020817c2b2b6fcd969cdd6055b002e103c73c5248c56fcd7a0909339eb60e2b9ccf2bbdc45883887361bbe63631e879e9c08fc13df3774e0
-
Filesize
160KB
MD53a7a38f0c80f7e609adb774a3d74f509
SHA1cacc5ce6b9b3ba06ed12a832fbfbafec60e655aa
SHA256887ebfd1b365a043a435d6e23649b5f0d4fcdc6b143be31228f7eb8146f509c7
SHA5121af7fbbbf020eab7c5e91394c95899cdaeea40aaefa265f58bc1c26091bcbd6ef4a308dcdd077e69dbb111b3aecc7c042fec201ba47891d6824f15ff9701723d
-
Filesize
158KB
MD5dfc32358acf8e8a7e6f13c271554fa06
SHA1d3c3208af1f5783ee788738460dcf3a234e4b010
SHA256ec05c9858e097bb423e7ad0af2b5c4fd3424ba470e76334f451b2300ca3ec944
SHA5124f5021d899d05741f4eef57fbebe6476a10ab899891620b1bc832b2af29caece8664637a3899b679bed6a45edaaf8cd4b95fc53379f18352890c7b992a510349
-
Filesize
22KB
MD5e77e9d216b52bbdcad73fe47bfb5debe
SHA18e522595424733a275aa7af7600175b200fee462
SHA2560be323496abfd4b8a246c44d1c6a790ea9866a114445a87fff7c2610a0808a08
SHA512f7fe76d23c4a79b23db50ba9739c5427c879d64d19c4f94ce5a28243c4726f20d6cf6757949e2dcb0720018614b488c07406d3ca745a870b70f87ca221a08436
-
Filesize
2.1MB
MD5ddfa82dd7995a1f1d1989da271d2d4ef
SHA1061fa31f10508a7039b36670da160f168ba3b26d
SHA256b06d887d7d545c308ae5ab1b2927c780d25adbb9865f14b6a61a0227e498a0e7
SHA51222caaeb378d19703d0098ca61e6843b507a8762884212326946a9839c91ff6624a4399b93a8062e7b4f76fb94ba1af52f4304f0469300fea4ca719372368abc6
-
Filesize
3.1MB
MD5fcf37fe41a8f0466c54cb9c01bdb441b
SHA1174ff3d88656d993fe29cf6da61b8412ef7d7841
SHA256e452d65faa47a924c141346dc3c38bdd281e9c77cb183dff4d20d6d08b039897
SHA51259c58793fbf63ad7db2223c7a1d4e43b4a0fe3a2356227ffa1b57186c2308387df77d4ea819937759671bc2e9586a31d5fe78119451be64bdb1eceb972ec8327
-
Filesize
300KB
MD5c58ceaff039ac8d0633b8e74e285fcb1
SHA1eb1f91176b8d39a75688ddec31c0a04d459da0fd
SHA2568e063579a9d83e81820d1328af4d9b6457386bd161466fd02826e2032282efeb
SHA512607836e3444836633436043c12ec0b19ef5b434e5aff017e6878c4fe4c9c835c346d3b2e7cded7844d152cda51d2981d82ca0ecc73b37c4a8bb9fb5b175ae95a
-
Filesize
922KB
MD5ae5d185887069aac46b8aa8918f88c77
SHA1ebcd4352d71f7ef4b8dad26be6d25cdf4b651f61
SHA256a937155612c6bf6257da4c4f835e68b02359540577db3f37729e1e2871f89ec1
SHA5125941e24085d70c6de29c0c345d7f5d8a683993f1ca218ae1655c14509a1968dc240c9dec611341ae37eceb410ade009bf6520f247eb753b4aba0886d9f2f8078
-
Filesize
948KB
MD52fb20c782c237f8b23df112326048479
SHA1b2d5a8b5c0fd735038267914b5080aab57b78243
SHA256e0305aa54823e6f39d847f8b651b7bd08c085f1dbbcb5c3c1ce1942c0fa1e9fa
SHA5124c1a67da2a56bc910436f9e339203d939f0bf854b589e26d3f4086277f2bec3dfce8b1f60193418c2544ef0c55713c90f6997df2bfb43f1429f3d00ba46b39b0
-
Filesize
122KB
MD5666213dc161525ade471727fc902b874
SHA16b3c36b8fac94465baecb1027a6107d8dad2f47d
SHA2561a2204993d2dcc6e344b6822c634ba901f07296839c5704bec0a0541beec0529
SHA512cd442bbbe82ba756ce5c8dedcd7e562b6275b89aeda537bee6578a8dcd89068d91ebaf1aa7429fdd9d50d2d802b1ad4d8e3d3f352af6b4f9ad405ac4e3a84010
-
Filesize
512KB
MD514aab81288f2fc4b1f9281581d4e279a
SHA1bac25da329cff0c4a07fa566dc685d91a31580ef
SHA2568306bfa4407a9efb05391024fcd0d1986c43c39d06577c8361b5f3b8b48ae5f9
SHA51252e6561fd4612acd4c5b6117dfbe047527dca5163ba2ef089a735324f79f9bcdc0cd7568979104b16ab55fe9115b145a0258ccda32df4d61bb9368346f01362d
-
Filesize
3.5MB
MD5a287be4e1ed7034fa4504d25d3fdfa6b
SHA1083934f2ee7504ad34d295528d9df8a04acc93df
SHA25684527db776684dc49ee0e309ba47ee369511fd26a076c8d1509d686f50cbb0af
SHA5128c0d50473f8004319cb0865501adcccb0a326a533041a8a9d2b3f78bc1613b565800b478c874f38d196e483615dee565187db185e294f88e39df6870ee53f28f
-
Filesize
2.2MB
-
Filesize
4.3MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.3MB
-
Filesize
2.2MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
324KB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.3MB
-
Filesize
4.3MB
-
Filesize
172KB
-
Filesize
184KB
-
Filesize
788KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.2MB
-
Filesize
1.3MB