Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-02-2025 05:15
General
-
Target
client32.exe
-
Size
117KB
-
MD5
a2b46c59f6e7e395d479b09464ecdba0
-
SHA1
92c132307dd21189b6d7912ddd934b50e50d1ec1
-
SHA256
89f0c8f170fe9ea28b1056517160e92e2d7d4e8aa81f4ed696932230413a6ce1
-
SHA512
4f4479ddcd9d0986aec3d789f9e14f9285e8d9d63a5b8f73c9e3203d3a53cd575b1e15edf0d5f640816bb7f25bd3501244e0f7c181a716a6804742ed2f1cf916
-
SSDEEP
768:rNd8VZl6FhWr80/aVr2pe/1G42KFKcMkjWBr2pe/zcKFKcMkA:rfO0hGSBee/1GVIrveee/IIrU
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Netsupport family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\client32.exe"C:\Users\Admin\AppData\Local\Temp\client32.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow