netsupport | 672eebccfb00a9a4cc11fec4232eff3c87f7870d1cef4c647d364801cab814ca

Analysis

max time kernel
62s
max time network
139s
platform
windows10_x64
resource
win10v20210410
submitted
16/06/2021, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1A44217A97C294C528D5DA09590E64E7.exe
Size 2.0MB
Sample210616-6hxcnpfchn
SHA256 672eebccfb00a9a4cc11fec4232eff3c87f7870d1cef4c647d364801cab814ca
MD5 1a44217a97c294c528d5da09590e64e7
SHA1 a9de727fae19a1c953bbe6cfb559906428f09e52
SHA512 42449580828f386daf00c68c6e2688c67e577dc921f035f1b487868eb928cdf0113953bf8bfdd9500ad82acbf417605e7e8b5196cff47c6c9377a33e5dc26134
MD5 SHA1 SHA512

Score

10^/10

netsupport rat

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Executes dropped EXE 1 IoCs

pid	Process
2796	client32.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autoruning.ini.lnk	1A44217A97C294C528D5DA09590E64E7.exe

Loads dropped DLL 6 IoCs

pid	Process
2796	client32.exe
2796	client32.exe
2796	client32.exe
2796	client32.exe
2796	client32.exe
2796	client32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2796	client32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2796	client32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 2796	3840	1A44217A97C294C528D5DA09590E64E7.exe	75
PID 3840 wrote to memory of 2796	3840	1A44217A97C294C528D5DA09590E64E7.exe	75
PID 3840 wrote to memory of 2796	3840	1A44217A97C294C528D5DA09590E64E7.exe	75

C:\Users\Admin\AppData\Local\Temp\1A44217A97C294C528D5DA09590E64E7.exe
"C:\Users\Admin\AppData\Local\Temp\1A44217A97C294C528D5DA09590E64E7.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Users\Admin\AppData\Roaming\WinSupport\client32.exe
  "C:\Users\Admin\AppData\Roaming\WinSupport\client32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads