Analysis
- max time kernel
121s - max time network
110s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
19/09/2024, 12:26
General
- Target ea34bd669623b802574b8da23549a66227b7aea5480e80289ec8b2ff6dc5cd7e.exe
- Size 6.2MB
- Sample240919-pmjrtayenr
- SHA256 ea34bd669623b802574b8da23549a66227b7aea5480e80289ec8b2ff6dc5cd7e
Malware Config
Signatures
- NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea34bd669623b802574b8da23549a66227b7aea5480e80289ec8b2ff6dc5cd7e.exe"C:\Users\Admin\AppData\Local\Temp\ea34bd669623b802574b8da23549a66227b7aea5480e80289ec8b2ff6dc5cd7e.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\TS Recovery Module\TSConverter.exe"C:\Users\Admin\AppData\Local\Programs\TS Recovery Module\TSConverter.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
AsMediaInput.dll
MSVCP120.dll
Qt5Core.dll
Qt5Widgets.dll
SDL.dll
TSConverter.exe
VCReport.dll
avcodec-56.dll
avfilter-5.dll
avutil-54.dll
main.dll
nsm.lic
qwindows.dll
s39o.0
sdw.0
sdw.1
AsPlayer.dll
CommonCtrls.dll
DownloadManager.dll
FfProfile.dll
FfVideoEditor.dll
FfmpegWrapper.dll
Framework.dll
Qt5Gui.dll
Qt5Network.dll
Qt5Sql.dll
Qt5Xml.dll
Utility.dll
avformat-56.dll
libcrypto-1_1.dll
libcurl.dll
libssl-1_1.dll
msvcr120.dll
swresample-1.dll
swscale-3.dll
sync.1.1.dll
memory/500-199-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-209-0x00000000067F0000-0x0000000006C34000-memory.dmp
memory/500-191-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-198-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-180-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-181-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-182-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-183-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-185-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-186-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-187-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-188-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-189-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-190-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-192-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-194-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-195-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-196-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-200-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-184-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-208-0x00000000067F0000-0x0000000006C34000-memory.dmp
memory/500-197-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-217-0x00000000071A0000-0x00000000072F9000-memory.dmp
memory/500-222-0x00000000071A0000-0x00000000072F9000-memory.dmp
memory/500-224-0x00000000071A0000-0x00000000072F9000-memory.dmp
memory/500-227-0x00000000724C0000-0x0000000072511000-memory.dmp
memory/500-232-0x0000000006570000-0x00000000066B0000-memory.dmp
memory/500-231-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-234-0x0000000008720000-0x0000000008972000-memory.dmp
memory/500-233-0x00000000067F0000-0x0000000006C34000-memory.dmp
memory/500-230-0x000000006ACC0000-0x000000006ACEB000-memory.dmp
memory/500-229-0x0000000071360000-0x000000007138E000-memory.dmp
memory/500-228-0x0000000071B00000-0x0000000071BC5000-memory.dmp
memory/500-251-0x00000000071A0000-0x00000000072F9000-memory.dmp
memory/500-265-0x00000000071A0000-0x00000000072F9000-memory.dmp
memory/500-278-0x00000000071A0000-0x00000000072F9000-memory.dmp
memory/500-283-0x00000000071A0000-0x00000000072F9000-memory.dmp
memory/500-193-0x000000006F2C0000-0x000000006F4FF000-memory.dmp
memory/500-280-0x00000000071A0000-0x00000000072F9000-memory.dmp