netsupport | 8075a6c09ff4c8e8637128dc8500d59fc6b2e24fcfe34b7bc782c079f10428fa

Analysis

max time kernel
125s
max time network
170s
platform
windows7_x64
resource
win7v20210408
submitted
30/08/2021, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8CD067BD2A3245B62F0411CA93594B1B.exe
Size 2.0MB
Sample210830-6bdekfrels
SHA256 8075a6c09ff4c8e8637128dc8500d59fc6b2e24fcfe34b7bc782c079f10428fa
MD5 8cd067bd2a3245b62f0411ca93594b1b
SHA1 8990a65174443066e7a54e03f790ba2c23459b9f
SHA512 c5082fe55e18f68f56925b299913db35b5d43419087555dc1f9a866d383cbbae9ccc87d6cde7626d9dce3b3240d547342cabe448eb0a49900952fcd3738a054a
MD5 SHA1 SHA512

Score

10^/10

netsupport rat

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Executes dropped EXE 1 IoCs

pid	Process
1248	client32.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autoruning.ini.lnk	8CD067BD2A3245B62F0411CA93594B1B.exe

Loads dropped DLL 8 IoCs

pid	Process
1924	8CD067BD2A3245B62F0411CA93594B1B.exe
1924	8CD067BD2A3245B62F0411CA93594B1B.exe
1248	client32.exe
1248	client32.exe
1248	client32.exe
1248	client32.exe
1248	client32.exe
1248	client32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1248	client32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1248	client32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1248	1924	8CD067BD2A3245B62F0411CA93594B1B.exe	26
PID 1924 wrote to memory of 1248	1924	8CD067BD2A3245B62F0411CA93594B1B.exe	26
PID 1924 wrote to memory of 1248	1924	8CD067BD2A3245B62F0411CA93594B1B.exe	26
PID 1924 wrote to memory of 1248	1924	8CD067BD2A3245B62F0411CA93594B1B.exe	26
PID 1924 wrote to memory of 1248	1924	8CD067BD2A3245B62F0411CA93594B1B.exe	26
PID 1924 wrote to memory of 1248	1924	8CD067BD2A3245B62F0411CA93594B1B.exe	26
PID 1924 wrote to memory of 1248	1924	8CD067BD2A3245B62F0411CA93594B1B.exe	26

C:\Users\Admin\AppData\Local\Temp\8CD067BD2A3245B62F0411CA93594B1B.exe
"C:\Users\Admin\AppData\Local\Temp\8CD067BD2A3245B62F0411CA93594B1B.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Roaming\WinSupport\client32.exe
  "C:\Users\Admin\AppData\Roaming\WinSupport\client32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-60-0x0000000076691000-0x0000000076693000-memory.dmp

Download