Overview

overview

10

Static

static

1

64aa1bf549...d5.msi

windows7-x64

10

64aa1bf549...d5.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/01/2025, 02:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    64aa1bf54917a57a946753e077a17fbe3e2a5957d21eaf47a808ac87bbfa77d5.msi
  • Size 52.9MB
  • Sample250129-c84ynayldw
  • SHA256 64aa1bf54917a57a946753e077a17fbe3e2a5957d21eaf47a808ac87bbfa77d5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
netsupportsectopratdiscoverypersistenceprivilege_escalationrattrojan

Malware Config

Signatures

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport
  • Netsupport family
    netsupport
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 2 IoCs
  • Sectoprat family
    sectoprat
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Blocklisted process makes network request 3 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 21 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\64aa1bf54917a57a946753e077a17fbe3e2a5957d21eaf47a808ac87bbfa77d5.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4504
    • C:\Users\Admin\AppData\Local\Temp\MSIC396.tmp
      "C:\Users\Admin\AppData\Local\Temp\MSIC396.tmp"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1116
      • C:\Users\Public\002.part01.exe
        "C:\Users\Public\002.part01.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3864
        • C:\Users\Public\Netstat\pivo.exe
          "C:\Users\Public\Netstat\pivo.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3904
          • C:\Users\Admin\AppData\Local\Temp\is-5KTME.tmp\pivo.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-5KTME.tmp\pivo.tmp" /SL5="$B006E,14420606,121344,C:\Users\Public\Netstat\pivo.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2312
            • C:\Users\Public\Netstat\pivo.exe
              "C:\Users\Public\Netstat\pivo.exe" /VERYSILENT
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4912
              • C:\Users\Admin\AppData\Local\Temp\is-6L178.tmp\pivo.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-6L178.tmp\pivo.tmp" /SL5="$90068,14420606,121344,C:\Users\Public\Netstat\pivo.exe" /VERYSILENT
                7⤵
                • Drops startup file
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:4576
                • C:\Users\Admin\AppData\Local\reclosable\flyvpn.exe
                  "C:\Users\Admin\AppData\Local\reclosable\flyvpn.exe"
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1836
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4160
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
            5⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:1456
          • C:\Users\Public\Netstat\bild.exe
            C:\Users\Public\Netstat\bild.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            PID:972
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4904
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 8AC4419F6BBA2ED198C76793DF260340 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2604
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:864
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding C804C2C89A1F86A9824ED91A6E4D9797
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4472
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2280

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e58588c.rbs
          • Path C:\Config.Msi\e58588c.rbs
          • Size 23KB
          • SHA256 1a323cf5618493170b96cbcde268927e243e1cd914fd2b558d66ff07ae131375
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          357F04AD41BCF5FE18FCB69F60C6680F_A314C346F0ECEE163F4030DE4E8B5330
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_A314C346F0ECEE163F4030DE4E8B5330
          • Size 1KB
          • SHA256 bdb9304dd7d692f7c663bef12bff2939e50941ab4af5036a268c4458c36aeb25
          • MD5 SHA1 SHA512
          Submit Download

          9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Size 1KB
          • SHA256 fdd1a2edbdd2821faafa2f4a83c288dad4b798d374f18ede052580ecd9bbf316
          • MD5 SHA1 SHA512
          Submit Download

          357F04AD41BCF5FE18FCB69F60C6680F_A314C346F0ECEE163F4030DE4E8B5330
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_A314C346F0ECEE163F4030DE4E8B5330
          • Size 540B
          • SHA256 acc2a9b6c76155a6d5f6e9573255e54723bb60f2d6c6eed8999e25b43ecbb0da
          • MD5 SHA1 SHA512
          Submit Download

          9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Size 536B
          • SHA256 62cc10d525fd70674d18349a5d9f2123a059cfe2b79901dfb40802f5fcc7dfe4
          • MD5 SHA1 SHA512
          Submit Download

          MSIBE9D.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSIBE9D.tmp
          • Size 1001KB
          • SHA256 e831a5aebc7bd941fa815a9441e552a0ba699f9bd5454036a68ccbb42200353a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC375.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSIC375.tmp
          • Size 1.1MB
          • SHA256 1b21039c84e860b0619a17d9f1508e5e622a1d4834b86e1b8eeffafe5d59f683
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC396.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSIC396.tmp
          • Size 47.8MB
          • SHA256 5a9cdecdf8a798789f44e8e650c05f6dca9fa2d8925d327d3a6c790eb093eabe
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pivo.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-5KTME.tmp\pivo.tmp
          • Size 1.1MB
          • SHA256 821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _isdecmp.dll
          • Path C:\Users\Admin\AppData\Local\Temp\is-B5GHN.tmp\_isetup\_isdecmp.dll
          • Size 29KB
          • SHA256 6535ba91fcca7174c3974b19d9ab471f322c2bf49506ef03424517310080be1b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          flyvpn.exe
          • Path C:\Users\Admin\AppData\Local\reclosable\flyvpn.exe
          • Size 13.9MB
          • SHA256 1d40788ce56c4cafdd19ae5f2b567e51234a32fa179ec8fba45452dd46b4fab1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          002.part01.exe
          • Path C:\Users\Public\002.part01.exe
          • Size 5.0MB
          • SHA256 af29953f9d537a2535e26f00b095db8d3eff4b6ae5b9503eb2a4bb2100d610fc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          002.part02.rar
          • Path C:\Users\Public\002.part02.rar
          • Size 5.0MB
          • SHA256 e38dd67843219eee7158d4d2735bbab121e7491763ff4271b1fa4b815b161b17
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          002.part03.rar
          • Path C:\Users\Public\002.part03.rar
          • Size 5.0MB
          • SHA256 0a3af047215cd3109e6c1830135a486a68718f9117cfa8bb7317a64d85bed83a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          002.part04.rar
          • Path C:\Users\Public\002.part04.rar
          • Size 5.0MB
          • SHA256 71f798e8d550a8b8279188f0a8b208bd4ddad9dd03adb4b766ac8fd90e283112
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          002.part05.rar
          • Path C:\Users\Public\002.part05.rar
          • Size 5.0MB
          • SHA256 983241b9c9446cc740069d9d00cbaaaf0c9a7e8dee29ce2a35394111d8eff308
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          002.part06.rar
          • Path C:\Users\Public\002.part06.rar
          • Size 5.0MB
          • SHA256 20491f1a14d9e583cf74993f752d28c85eb6e73df0c0a469d89947f13a1c17c0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          002.part07.rar
          • Path C:\Users\Public\002.part07.rar
          • Size 5.0MB
          • SHA256 48d128d05b695806e558b5d76b3b8aedbab458b73c6d9c5e9bce89371a6542e3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          002.part08.rar
          • Path C:\Users\Public\002.part08.rar
          • Size 5.0MB
          • SHA256 ad48f4e08f20455610bfc0cc73fea6c926fd2558b4fd66dc66aad9454e1e52fd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          002.part09.rar
          • Path C:\Users\Public\002.part09.rar
          • Size 5.0MB
          • SHA256 d3940dfb44bd59391a545c2aeb5520960c082edf70c2ee7464f175f51753ba90
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          002.part10.rar
          • Path C:\Users\Public\002.part10.rar
          • Size 2.7MB
          • SHA256 b5bce1d49744f35bb215c142aabf4652bab6dc4ce65b974dcb52e21b816e7472
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          HTCTL32.DLL
          • Path C:\Users\Public\Netstat\HTCTL32.DLL
          • Size 320KB
          • SHA256 edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          NSM.LIC
          • Path C:\Users\Public\Netstat\NSM.LIC
          • Size 257B
          • SHA256 2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12
          • MD5 SHA1 SHA512
          Submit Download

          PCICHEK.DLL
          • Path C:\Users\Public\Netstat\PCICHEK.DLL
          • Size 18KB
          • SHA256 313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          PCICL32.dll
          • Path C:\Users\Public\Netstat\PCICL32.dll
          • Size 3.6MB
          • SHA256 63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bild.exe
          • Path C:\Users\Public\Netstat\bild.exe
          • Size 103KB
          • SHA256 49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          client32.ini
          • Path C:\Users\Public\Netstat\client32.ini
          • Size 702B
          • SHA256 277b9bcb5778cd5dc167ed75528818b06ed12f3fd427339f3085f4db8a39ed2e
          • MD5 SHA1 SHA512
          Submit Download

          msvcr100.dll
          • Path C:\Users\Public\Netstat\msvcr100.dll
          • Size 755KB
          • SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          netsup.bat
          • Path C:\Users\Public\Netstat\netsup.bat
          • Size 161B
          • SHA256 d6f183097bf12a7f68632efecc6dc7ddac16002839229502b32cd40826dd472c
          • MD5 SHA1 SHA512
          Submit Download

          pcicapi.dll
          • Path C:\Users\Public\Netstat\pcicapi.dll
          • Size 32KB
          • SHA256 9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pivo.exe
          • Path C:\Users\Public\Netstat\pivo.exe
          • Size 17.3MB
          • SHA256 8777be6a537392b72fae3846d7f249cc64caa5ca9eff09f096270c0b6479dc63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/1836-205-0x0000000005630000-0x00000000057F2000-memory.dmp
          Download

          memory/1836-207-0x00000000058D0000-0x0000000005920000-memory.dmp
          Download

          memory/1836-206-0x0000000005800000-0x0000000005876000-memory.dmp
          Download

          memory/1836-203-0x0000000004E20000-0x0000000004EB2000-memory.dmp
          Download

          memory/1836-204-0x0000000005000000-0x00000000055A4000-memory.dmp
          Download

          memory/1836-200-0x0000000002200000-0x00000000022CA000-memory.dmp
          Download

          memory/1836-202-0x0000000004EF0000-0x0000000004FB6000-memory.dmp
          Download

          memory/2312-170-0x0000000000400000-0x000000000052D000-memory.dmp
          Download

          memory/3904-134-0x0000000000400000-0x0000000000428000-memory.dmp
          Download

          memory/3904-174-0x0000000000400000-0x0000000000428000-memory.dmp
          Download

          memory/4576-199-0x0000000000400000-0x000000000052D000-memory.dmp
          Download

          memory/4576-187-0x0000000000400000-0x000000000052D000-memory.dmp
          Download

          memory/4912-186-0x0000000000400000-0x0000000000428000-memory.dmp
          Download

          memory/4912-167-0x0000000000400000-0x0000000000428000-memory.dmp
          Download