Overview

overview

10

Static

static

1

65110470f6...94.exe

windows7-x64

7

65110470f6...94.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    65110470f6c6c96877e96a640adcf6178186b675e6d1bc24c19f977a12220294.exe

  • Size

    16.1MB

  • Sample

    241102-f1btpazaqc

  • MD5

    446a85d94adb8e2e9157170b82592d6a

  • SHA1

    1ea726940904e568dbdc4a6ef50b61cae6bb55ea

  • SHA256

    65110470f6c6c96877e96a640adcf6178186b675e6d1bc24c19f977a12220294

  • SHA512

    96684b30d90f32a57b8b264da520c31b063991830e472798d46147e3811fcd27e5c400f7fd3832b5ed0975e43b2efd6cbebd152b58442dd5e630416de6a0e0fe

  • SSDEEP

    393216:qxxFZAWTc+MZ3mOvSY6oDXtVVFOzWyY4bkZsFVf:wAL+WmOvS9qDSzJbki

Score
10/10
netsupportdiscoveryexecutionpersistencerat

Malware Config

Targets

    • Target

      65110470f6c6c96877e96a640adcf6178186b675e6d1bc24c19f977a12220294.exe

    • Size

      16.1MB

    • MD5

      446a85d94adb8e2e9157170b82592d6a

    • SHA1

      1ea726940904e568dbdc4a6ef50b61cae6bb55ea

    • SHA256

      65110470f6c6c96877e96a640adcf6178186b675e6d1bc24c19f977a12220294

    • SHA512

      96684b30d90f32a57b8b264da520c31b063991830e472798d46147e3811fcd27e5c400f7fd3832b5ed0975e43b2efd6cbebd152b58442dd5e630416de6a0e0fe

    • SSDEEP

      393216:qxxFZAWTc+MZ3mOvSY6oDXtVVFOzWyY4bkZsFVf:wAL+WmOvS9qDSzJbki

    Score
    10/10
    discoveryexecutionnetsupportpersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks