Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-11-2024 11:32
General
-
Target
uclient.exe
-
Size
104KB
-
MD5
beaac58fbfb2c65866cdf69cd785a48b
-
SHA1
06c1b477be2d08aac95d9682c8ae75871a816bdc
-
SHA256
860393e31788499f8774be83c65bcf29658cc77bf96ee2f4c86b065aedbf77de
-
SHA512
e2a35ecee75316d9a3dbb2ee49f451980375f0b43ca8db5102858b90e840e5c8b4c45ac5c0ce6593e69fc664d92866b60db609fb64029c3ec7a50dc8fee4ad4e
-
SSDEEP
384:KIXhLZ758V5+6j6Qa86Fkv2Wr120hZB4zSrrIzezaV7raI5acim:ldd8VZl6FhWr80/q2r5zaVvaMacim
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Netsupport family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\uclient.exe"C:\Users\Admin\AppData\Local\Temp\uclient.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow