Analysis
-
max time kernel
119s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 12:46
General
-
Target
ea34bd669623b802574b8da23549a66227b7aea5480e80289ec8b2ff6dc5cd7eN.exe
-
Size
6.2MB
-
MD5
f30257ceae9a67d36a4e62f20ca7da00
-
SHA1
e3ca7a72b61fac410b406163ecc299b89f01224a
-
SHA256
ea34bd669623b802574b8da23549a66227b7aea5480e80289ec8b2ff6dc5cd7e
-
SHA512
f301745a2474911510066eb58178a804c1aedff3f40102b1ecd6078dd87ee59f12dd6217c23481c1ef78ab625079e1a733ae70d7de470a321802a5f0afcf378b
-
SSDEEP
98304:Cwi471aEj6tOKNnwp2QNNVNDP+f4GXpcNB6wijexMRq:I4AErp2oWj5fjexb
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea34bd669623b802574b8da23549a66227b7aea5480e80289ec8b2ff6dc5cd7eN.exe"C:\Users\Admin\AppData\Local\Temp\ea34bd669623b802574b8da23549a66227b7aea5480e80289ec8b2ff6dc5cd7eN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\TS Recovery Module\TSConverter.exe"C:\Users\Admin\AppData\Local\Programs\TS Recovery Module\TSConverter.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
445KB
MD551cebffde43c239da5e69b0e64954522
SHA1a2f4bc0f6a7b49ea3902d654a953b3cc2239e6c1
SHA256ceaa4c00412760b2f15c241f2d7b57bc4744c15d3d1157d9d2a9693d2ee84318
SHA512e0d641e7ad666115f50dff0a304b8f3fa03f2d86f64ad38159c86bd3724682d12b3f5cdbe06ddebefa00e6d3abc5a4a0519170b6029c959ed93a8255935f7ae6
-
Filesize
213KB
MD58b0f978c7615eab0fc9b0bb6d60b3edc
SHA15f6116f0fdf43f40933e909597d1d263cb0da348
SHA256c10eba110d341c2d3a52bbca670d47d2a8a586b0ac09150b7b639e22885e79be
SHA5122756c2f509680a5e0e8316dcfe201a74ba61efedb9e15aba790edc1fa792cb133e3b8197112b625a623c6bbc59953808953c2b2e55e22f673a3aef8b8fe0b308
-
Filesize
111KB
MD575a2af2dea3da4e77bfe3939ce779fa8
SHA14cd02b95ca14d23947f578de1473b939117f4303
SHA2569e2d384fb2b7c0d044400729f1f7b85284f62497b2db619059fc16aa76077027
SHA512a74be65b74822fa3baad9d424b81ea164f1bad39ed15695ee8b90b352b3cbe8e264391f004622af45294abdda045df97835dbfafe67ae831954896944f2e116d
-
Filesize
63KB
MD5494aca51661c838a2e6b6035aa3dc8e3
SHA10456add0c5a4617bf6a0a8973fc4faadeb399021
SHA25679fc5eed59b3ce4d97490074c0d189aeb721fa5e84c503371f4b665de7fab609
SHA5121818f1be75eedd7cc9782454313c2b23bd8d9c76cc954af7ce1a96ce0688632a3ba933a5da85e54efc7d0d900b884d32b122b6215ecef5a423cffdadd644cebf
-
Filesize
334KB
MD57a99eacb3808e194ec874c66fc86a603
SHA17383c7cf256a461f2747ce9f72dfb172904a8090
SHA256dcad80572bc2336cddd99d9abc432d241554dd0b694b36f5031be5a993232b88
SHA512273b977cc56c01149f13592c31f6b6595825cce41ef5bcc501aec6d8758bc446294d961ca24ac6a2a61c2c43490f8348dfd6c6ae5c166a236b634d501ea3a3f2
-
Filesize
1.0MB
MD597638522de02899961efa883e48af48a
SHA17921f7c4b0a4fdf8d78a66d3ab0bbd445f59ea9f
SHA256db00ca4f3b8e9b127b28921d88ed5efcaec342bef510367556fc15c81e6f99e2
SHA512a7d5c538a157a145110708a3d374ff11d64b781942b3a87891cdfd834baff04ccb29da4705ac79f741f1c29041703f4568d57a5161025457d93f66f2059b4740
-
Filesize
242KB
MD5362be76a3f8c15111aaeb3e2316a2ade
SHA1b544dd53e8a16e7d257ed8c9070af57647c395a5
SHA25676ecf30a1a83d49fb710f4b808884a285f82e9242a81228beeb767848d6ead44
SHA512eab608c54b2ea32a0fa197157ab65e79beb2a6e030c018db13b6e2a0f338ad26842a9ea2258e5f43387a8c9e5fbf2f1e54fb7ab15b1d82d23362382a4555f7e2
-
Filesize
1013KB
MD5d224e12162e977ede4fe2d07380c5b22
SHA13b8ae72d45c544efe4dda03c5aa6443eda4e1279
SHA256fdef4926120a2f5bf25256c7a0300e203e476e60a29c333e73b2dba515465035
SHA5126c103264bbd597000201654843857d48408c6e36350b779fc283774e4b38d0e04ae1b62ac95bb3154ea7c7371c03302beedbfcfb3fc37f55ad7cabe8aec19cca
-
Filesize
444KB
MD5a883c95684eff25e71c3b644912c73a5
SHA13f541023690680d002a22f64153ea4e000e5561b
SHA256d672fb07a05fb53cc821da0fde823fdfd46071854fe8c6c5ea83d7450b978ecb
SHA5125a47c138d50690828303b1a01b28e6ef67cfe48215d16ed8a70f2bc8dbb4a73a42c37d02ccae416dc5bd12b7ed14ff692369bc294259b46dbf02dc1073f0cb52
-
Filesize
948KB
MD52fb20c782c237f8b23df112326048479
SHA1b2d5a8b5c0fd735038267914b5080aab57b78243
SHA256e0305aa54823e6f39d847f8b651b7bd08c085f1dbbcb5c3c1ce1942c0fa1e9fa
SHA5124c1a67da2a56bc910436f9e339203d939f0bf854b589e26d3f4086277f2bec3dfce8b1f60193418c2544ef0c55713c90f6997df2bfb43f1429f3d00ba46b39b0
-
Filesize
4.5MB
MD5678c947dec2979c843f8cdd24796ef46
SHA1f5f8f41e6480f9b42344241b76e8e384adb6b9a0
SHA2560b407af1ed1a77ffd7503ed396a1091e41e0ae6865204d3e38dc6af147a1dbf2
SHA512e34583d7cfe5b555d59218b019469171c02e2a193e74f9cb587a24e0abd82969102bdf0c4a06929f1c13602d613b43f653b58c233e7edbd5d1d4c5db2a707055
-
Filesize
4.8MB
MD56d77fd2afc773f604380e34172f313d6
SHA18c938f8000e262746eae7ef9fbb813eb2302e674
SHA256f719214250d7b36bfddfd78b2d094500f025a8d50d0e297d9c29927e65a4aeca
SHA5128ae8153d5d69ab9596f9ca572f75d817cc9a7b2005915b438e4448114d05ffa4b6ac0426ecfd6cdbbda26461a766a1ca58b0cd7f8d0ef09c5d3a91c19547fed1
-
Filesize
844KB
MD511a576944c9aaadcd9deb12dfc173bd7
SHA1ac08ddd705859529241310abfea6280f5554306b
SHA256fce717eecf407cafdf6a30f33246e3244a568ef06d9077823695d014c79f910c
SHA5125fde256826f8e5a4020817c2b2b6fcd969cdd6055b002e103c73c5248c56fcd7a0909339eb60e2b9ccf2bbdc45883887361bbe63631e879e9c08fc13df3774e0
-
Filesize
160KB
MD53a7a38f0c80f7e609adb774a3d74f509
SHA1cacc5ce6b9b3ba06ed12a832fbfbafec60e655aa
SHA256887ebfd1b365a043a435d6e23649b5f0d4fcdc6b143be31228f7eb8146f509c7
SHA5121af7fbbbf020eab7c5e91394c95899cdaeea40aaefa265f58bc1c26091bcbd6ef4a308dcdd077e69dbb111b3aecc7c042fec201ba47891d6824f15ff9701723d
-
Filesize
4.3MB
MD526110086dd51fe3b5c864e0e3578aefc
SHA13be4e4f87f5dfdb58e0cfd9b7745de3e48d45df4
SHA25664d2a7dae905617df9833118247c10de51352aa48dd9c72ae5c223f3ed54b4b4
SHA512a852e740d7a0cf41bc6329a259c3a2ced80f9d3654b3e23bc5b9c0eb93552a26850d7ebcc824c7648550d1b5d7bdc6c8809d0bbb1c68a4856669fadf5e48aceb
-
Filesize
158KB
MD5dfc32358acf8e8a7e6f13c271554fa06
SHA1d3c3208af1f5783ee788738460dcf3a234e4b010
SHA256ec05c9858e097bb423e7ad0af2b5c4fd3424ba470e76334f451b2300ca3ec944
SHA5124f5021d899d05741f4eef57fbebe6476a10ab899891620b1bc832b2af29caece8664637a3899b679bed6a45edaaf8cd4b95fc53379f18352890c7b992a510349
-
Filesize
184KB
MD5f6f5488c05f0c4a347d927bd10f6b36e
SHA1b889342b7d64d53dc08773c3653ea494f1eca08b
SHA2569f30e1d9f9f18f57b06a447f825e7483dc1ccdec7ae4440e50afd00b9e820be9
SHA512f4d41b1323916e95b9e76ce220e66710f380d5806f4d47f9a4fab2e94f78980106c88955ea8ce1a713a43e95ae4aca5fda792ce91931d733049a610e4a65f945
-
Filesize
22KB
MD5e77e9d216b52bbdcad73fe47bfb5debe
SHA18e522595424733a275aa7af7600175b200fee462
SHA2560be323496abfd4b8a246c44d1c6a790ea9866a114445a87fff7c2610a0808a08
SHA512f7fe76d23c4a79b23db50ba9739c5427c879d64d19c4f94ce5a28243c4726f20d6cf6757949e2dcb0720018614b488c07406d3ca745a870b70f87ca221a08436
-
Filesize
29KB
MD5effab3ddc3d33491f066903c4c95d361
SHA19be3bf66f3b8990fa919b5459b564a34ab81aaeb
SHA256fddaecd2bd619e12fc2916e196592488090d558a9668429f570582b0ea557028
SHA5128a569acd8fa384e1b529b7d63041d247e88cc15ef0477b457a7ed6d43a21b13e814193085224f67233c554b9d5e8aa598504fc3d3c1dd9650e69784d20d4d993
-
Filesize
19.0MB
MD5d252bad2bb26a0b1b7cb46ac36394a65
SHA14185c56dd7408df6ad1a10cd94905af1c06a3ecc
SHA256484cf9310f35f79f83ba5327e20909420d0cea286ed0ea8fa5755bd5f2b00ce3
SHA51266e8eb94097932460f4df82d56ea00807b89e0ea78806d5618daa2a3521b5a343162b42ea68cf491114708d86aab018a0df4486793c31fee7e150a97c8a7ea20
-
Filesize
1.2MB
MD54dc29ce2b9ee297a6a1f4f8ac04b8acb
SHA157253632652dd8f04a8726d7fc5bc0dab515392a
SHA256a2c74d26143fa42ff496776959ed6ee1eba5bd64f97089fcff674a11a51a6d67
SHA512afb1f72451e0d19001be410b84c0437cd3aec6b1524895661e07f41ecca9fb763bf3c677538b416a36fd57bf779f49a824c6a7d0a9540f5a0a38b40e6a786a4d
-
Filesize
2.1MB
MD5ddfa82dd7995a1f1d1989da271d2d4ef
SHA1061fa31f10508a7039b36670da160f168ba3b26d
SHA256b06d887d7d545c308ae5ab1b2927c780d25adbb9865f14b6a61a0227e498a0e7
SHA51222caaeb378d19703d0098ca61e6843b507a8762884212326946a9839c91ff6624a4399b93a8062e7b4f76fb94ba1af52f4304f0469300fea4ca719372368abc6
-
Filesize
410KB
MD59c200ca1d22c6b82a172e715cc82d526
SHA19aa93fb66d6d4c06595c24348748d70c3211843a
SHA256ca176820ec3ff40076f1c4977c81d2ef7e3165a6674187e4175f34fb3926c77c
SHA512a30f4ff1f71db7c21c4a6a1ab7c956c98d82ceb02ca93639649678aa24f3ad08641ac30a0f7c19d3e9d8c38857bf368002ca78e4fb7ceb26db21d23a9cdfba45
-
Filesize
316KB
MD5051cdb6ac8e168d178e35489b6da4c74
SHA138c171457d160f8a6f26baa668f5c302f6c29cd1
SHA2566562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269
SHA512602ab9999f7164a2d1704f712d8a622d69148eefe9a380c30bc8b310eadedf846ce6ae7940317437d5da59404d141dc2d1e0c3f954ca4ac7ae3497e56fcb4e36
-
Filesize
1.8MB
MD5cfe074b1217e9e86624ac2f2c2eaeec1
SHA1d86eb4f8f8eefcbaa5b2df95bf6d715ec087e806
SHA256bd802b5ac3481a974e13126d5fadfbea8262f51ee04ef210d27fdd8619732b7b
SHA5122d1eb184e3903463aa9a3ce24869583be78aae52ee52889018e6b79edbc294d49caa7f753152188aa16541a52dd3d8b224f94e143908f2eafd3f3979c296d3fd
-
Filesize
3.1MB
MD5fcf37fe41a8f0466c54cb9c01bdb441b
SHA1174ff3d88656d993fe29cf6da61b8412ef7d7841
SHA256e452d65faa47a924c141346dc3c38bdd281e9c77cb183dff4d20d6d08b039897
SHA51259c58793fbf63ad7db2223c7a1d4e43b4a0fe3a2356227ffa1b57186c2308387df77d4ea819937759671bc2e9586a31d5fe78119451be64bdb1eceb972ec8327
-
Filesize
300KB
MD5c58ceaff039ac8d0633b8e74e285fcb1
SHA1eb1f91176b8d39a75688ddec31c0a04d459da0fd
SHA2568e063579a9d83e81820d1328af4d9b6457386bd161466fd02826e2032282efeb
SHA512607836e3444836633436043c12ec0b19ef5b434e5aff017e6878c4fe4c9c835c346d3b2e7cded7844d152cda51d2981d82ca0ecc73b37c4a8bb9fb5b175ae95a
-
Filesize
922KB
MD5ae5d185887069aac46b8aa8918f88c77
SHA1ebcd4352d71f7ef4b8dad26be6d25cdf4b651f61
SHA256a937155612c6bf6257da4c4f835e68b02359540577db3f37729e1e2871f89ec1
SHA5125941e24085d70c6de29c0c345d7f5d8a683993f1ca218ae1655c14509a1968dc240c9dec611341ae37eceb410ade009bf6520f247eb753b4aba0886d9f2f8078
-
Filesize
673KB
MD5ff3f9fcb6dac5ed607008a117dfcbcb5
SHA1d53a919936575147681e6d86808e04346fd67a95
SHA2561f01405fcd4c108862159469da98010346db94de971053132a515252caa95a4d
SHA512ad30496099ca5901e327beb3b1ffa493c9ee8210c559285b344bd506f4624aca3ec4193de36f4da45246be1917d388698574a6fc0baa9d38e374cf89a6dc5177
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
261B
MD5886e4bb84e1ecc4a04ae599d76fcce1d
SHA13f0493bb2088af50bcc8223462db0b207354e946
SHA2565eeb014e3b390e0c85ce72988d422dcd9de1520566b11755c70bdd9bb7376060
SHA512f4db9038a113c4b1e2462b3e0becef2500c9532a79c8187f51d011d690bc68c6d1a99585e43136cb082bd6a232136546db50265f226ff19e67d8430306a8761f
-
Filesize
14KB
MD53aabcd7c81425b3b9327a2bf643251c6
SHA1ea841199baa7307280fc9e4688ac75e5624f2181
SHA2560cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f
SHA51297605b07be34948541462000345f1e8f9a9134d139448d4f331cefeeca6dad51c025fcab09d182b86e5a4a8e2f9412b3745ec86b514b0523497c821cb6b8c592
-
Filesize
997KB
MD5382166cd2b5ceeba4237104f9b0c0e14
SHA1d5fbfe37c92f8016334faceb2e2e219871b4d431
SHA256c24bb651c1ab40f3afe045ce15b613f8b481795957b77387f9ce3bad1e4377b9
SHA512b60e1ea7b397a9d2fc2123cdb815c58c2573dfacb4386ec213fce3052e94cc63871c63b959ef6168ae9ad7e10bd21987fff5a4008e01ee00e8466c3e9acf8ce0
-
Filesize
512KB
MD514aab81288f2fc4b1f9281581d4e279a
SHA1bac25da329cff0c4a07fa566dc685d91a31580ef
SHA2568306bfa4407a9efb05391024fcd0d1986c43c39d06577c8361b5f3b8b48ae5f9
SHA51252e6561fd4612acd4c5b6117dfbe047527dca5163ba2ef089a735324f79f9bcdc0cd7568979104b16ab55fe9115b145a0258ccda32df4d61bb9368346f01362d
-
Filesize
3.5MB
MD5a287be4e1ed7034fa4504d25d3fdfa6b
SHA1083934f2ee7504ad34d295528d9df8a04acc93df
SHA25684527db776684dc49ee0e309ba47ee369511fd26a076c8d1509d686f50cbb0af
SHA5128c0d50473f8004319cb0865501adcccb0a326a533041a8a9d2b3f78bc1613b565800b478c874f38d196e483615dee565187db185e294f88e39df6870ee53f28f
-
Filesize
16KB
MD5456e899c3982eef8abd2a0aa80854aaf
SHA18280293e14aeeaf5ea2be89fc403964315719f27
SHA256ab31e78f9d11ae0bd08403ddc6e447228cd88c5570d913b69b660f812e272dda
SHA512d0e79ef71fb9661620d163f288c00bd6d764ed5dd2097bac3ffcd971ee888028aceac9105ac93760bf789381e023d4ef9b856fc376695f973ec4cf97439e9c36
-
Filesize
16KB
MD53c08bc81f7a46efea853e09445db5d43
SHA1e134a1a2d3f2099b373ef35034366b10f5600306
SHA256a2b001bd9cd7bf2bbbe848ea8b624ed83d2821f55038b7695c4eb853622e4428
SHA51281d697edcd9ab663363adddc79c6ea1907a647cd639fdda4546549d4902c3a3335572a364624f0ab3fcb03877ba5c3679aa50326159450398cdf5655b46744f6
-
Filesize
16KB
MD576a3fa44b1b322d406675071927ebee2
SHA1f971958adab50cfcc828af6bc31e9943b5798398
SHA25692c24e8412d32e67767ee8f3caef030230f10743b3af8a6ca04db1ff35e1b9f0
SHA51210a2b1a27c4cc64c44807b3044e55e44a872da3282f22f39445a1983b14c97ed8b95606099294ec70021dad20e5651b6c809d001dd2424626a2725f6d70444fb
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
26.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
26.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
26.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
26.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
26.0MB
-
Filesize
2.0MB
-
Filesize
4.3MB
-
Filesize
26.0MB
-
Filesize
26.0MB
-
Filesize
4.3MB
-
Filesize
26.0MB
-
Filesize
26.0MB
-
Filesize
26.0MB
-
Filesize
980KB