netsupport | 8075a6c09ff4c8e8637128dc8500d59fc6b2e24fcfe34b7bc782c079f10428fa

Analysis

max time kernel
21s
max time network
133s
platform
windows10_x64
resource
win10v20210408
submitted
30/08/2021, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8CD067BD2A3245B62F0411CA93594B1B.exe
Size 2.0MB
Sample210830-6bdekfrels
SHA256 8075a6c09ff4c8e8637128dc8500d59fc6b2e24fcfe34b7bc782c079f10428fa
MD5 8cd067bd2a3245b62f0411ca93594b1b
SHA1 8990a65174443066e7a54e03f790ba2c23459b9f
SHA512 c5082fe55e18f68f56925b299913db35b5d43419087555dc1f9a866d383cbbae9ccc87d6cde7626d9dce3b3240d547342cabe448eb0a49900952fcd3738a054a
MD5 SHA1 SHA512

Score

10^/10

netsupport rat

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Executes dropped EXE 1 IoCs

pid	Process
3512	client32.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autoruning.ini.lnk	8CD067BD2A3245B62F0411CA93594B1B.exe

Loads dropped DLL 6 IoCs

pid	Process
3512	client32.exe
3512	client32.exe
3512	client32.exe
3512	client32.exe
3512	client32.exe
3512	client32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3512	client32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3512	client32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 3512	528	8CD067BD2A3245B62F0411CA93594B1B.exe	75
PID 528 wrote to memory of 3512	528	8CD067BD2A3245B62F0411CA93594B1B.exe	75
PID 528 wrote to memory of 3512	528	8CD067BD2A3245B62F0411CA93594B1B.exe	75

C:\Users\Admin\AppData\Local\Temp\8CD067BD2A3245B62F0411CA93594B1B.exe
"C:\Users\Admin\AppData\Local\Temp\8CD067BD2A3245B62F0411CA93594B1B.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:528
- C:\Users\Admin\AppData\Roaming\WinSupport\client32.exe
  "C:\Users\Admin\AppData\Roaming\WinSupport\client32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads