Analysis
-
max time kernel
135s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-10-2024 17:35
General
-
Target
client32/client32.exe
-
Size
99KB
-
MD5
aca274219070da800e92a8cae61235bc
-
SHA1
7347b65bb6eaf0931220bb201c39a66206f0d2c4
-
SHA256
21903b51f23f7af681a9f69aa066753b202af6c537b97a247d98cfbdec150d63
-
SHA512
08df88938059e7324b755c3bc88d8943aaaf6f9244c748f521b265fd0417750e067cff077875d0168a440ad0b5fd3c1b0fa4dd5335bd707d4bf3b07e6c6ede2a
-
SSDEEP
768:qHcHeEYjB9aFIrdXrY/TEqMVnYYEFwGxDrLabMiF:qHHF9qEGMVntqxUn
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\client32\client32.exe"C:\Users\Admin\AppData\Local\Temp\client32\client32.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow