netsupport | bb088550eb2fa3f631fd5dfb18f7cc88a88132e2e664331a5b883ca57106f7d3

Analysis

max time kernel
87s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2023 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb088550eb2fa3f631fd5dfb18f7cc88a88132e2e664331a5b883ca57106f7d3.exe
Size

2.6MB
MD5

a2d6ea98beebf0cca26484327441f3b2
SHA1

8b8fd472458985e36d24f624f94fdae56e79a644
SHA256

bb088550eb2fa3f631fd5dfb18f7cc88a88132e2e664331a5b883ca57106f7d3
SHA512

57f5e4a10b06d243a3df61b3cec466e8fc0ee9863edfa0602c0077fbc42952ff8bee44c6828333b42132a3d3ce56f375e910db89fbebf046c4fa0b3075ca0764
SSDEEP

49152:+dUQfiMRDREkPWgd/CIWxOI1gaf9DViTm4lNVPyTxrSjpU:+dVaMRDNPWu/C1xOa3MmKyTxrx

Score

10^/10

netsupport rat

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	bb088550eb2fa3f631fd5dfb18f7cc88a88132e2e664331a5b883ca57106f7d3.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autorunser.ini.lnk	bb088550eb2fa3f631fd5dfb18f7cc88a88132e2e664331a5b883ca57106f7d3.exe

Executes dropped EXE 1 IoCs

pid	Process
2324	client32.exe

Loads dropped DLL 6 IoCs

pid	Process
2324	client32.exe
2324	client32.exe
2324	client32.exe
2324	client32.exe
2324	client32.exe
2324	client32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2324	client32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2324	client32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 2324	4088	bb088550eb2fa3f631fd5dfb18f7cc88a88132e2e664331a5b883ca57106f7d3.exe	83
PID 4088 wrote to memory of 2324	4088	bb088550eb2fa3f631fd5dfb18f7cc88a88132e2e664331a5b883ca57106f7d3.exe	83
PID 4088 wrote to memory of 2324	4088	bb088550eb2fa3f631fd5dfb18f7cc88a88132e2e664331a5b883ca57106f7d3.exe	83

C:\Users\Admin\AppData\Local\Temp\bb088550eb2fa3f631fd5dfb18f7cc88a88132e2e664331a5b883ca57106f7d3.exe
"C:\Users\Admin\AppData\Local\Temp\bb088550eb2fa3f631fd5dfb18f7cc88a88132e2e664331a5b883ca57106f7d3.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Users\Admin\AppData\Roaming\windows_update_513432\client32.exe
  "C:\Users\Admin\AppData\Roaming\windows_update_513432\client32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\windows_update_513432\HTCTL32.DLL

Filesize
320KB

MD5
c94005d2dcd2a54e40510344e0bb9435

SHA1
55b4a1620c5d0113811242c20bd9870a1e31d542

SHA256
3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899

SHA512
2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

Download Submit
C:\Users\Admin\AppData\Roaming\windows_update_513432\HTCTL32.DLL

Filesize
320KB

MD5
c94005d2dcd2a54e40510344e0bb9435

SHA1
55b4a1620c5d0113811242c20bd9870a1e31d542

SHA256
3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899

SHA512
2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

Download Submit
C:\Users\Admin\AppData\Roaming\windows_update_513432\MSVCR100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Roaming\windows_update_513432\NSM.LIC

Filesize
259B

MD5
6b5215aa2cf4128127b390c5bcb90ce7

SHA1
100b116bae562f066f61cc5f0b339d466f90e0ff

SHA256
99dfc0b55bf27abc581f37c914ed0ca0522ad9f9685b3e4f73079e87ebbdbcba

SHA512
98ce6521c46880ee8e98796fc4e712f9e858201ca89a352884d7b0325b43d6e2de2c0a87ba504db5c9409aa699e91e26e616e285e26543388c6395696b6daa5c

Download Submit
C:\Users\Admin\AppData\Roaming\windows_update_513432\PCICHEK.DLL

Filesize
31KB

MD5
d6fcd63035d9b341c7e165e6e553d3cc

SHA1
3101fef674479b8b63da592d6b8feebfce7fd503

SHA256
265623112eafca985d5acd9db3b5f9e00b39cc1f15cdd5b181d3eb0d413b97de

SHA512
e7136af44c3a69126517046fb36fed38f0c396d2a0a43c00feee3438125b38f91efa6d5e2ba18750924a35431b347f30b71382a9549d24c397f8c5871d50aef3

Download Submit
C:\Users\Admin\AppData\Roaming\windows_update_513432\PCICL32.DLL

Filesize
3.6MB

MD5
d3d39180e85700f72aaae25e40c125ff

SHA1
f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15

SHA256
38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5

SHA512
471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f

Download Submit
C:\Users\Admin\AppData\Roaming\windows_update_513432\PCICL32.dll

Filesize
3.6MB

MD5
d3d39180e85700f72aaae25e40c125ff

SHA1
f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15

SHA256
38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5

SHA512
471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f

Download Submit
C:\Users\Admin\AppData\Roaming\windows_update_513432\client32.exe

Filesize
117KB

MD5
c0eb3eac96511077dafc0afa64c6388c

SHA1
33e81f25493eda3bbf0b7cdcddd523547fa6c31e

SHA256
eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a

SHA512
2632bef55323d9a272e1519e2b2792527d28cbd9fe6a9f9d253e5729978be0de6f36b8e3b2acee70449ba22a33efb41c82c82afe19dad14698b3ada0006ca7fc

Download Submit
C:\Users\Admin\AppData\Roaming\windows_update_513432\client32.exe

Filesize
117KB

MD5
c0eb3eac96511077dafc0afa64c6388c

SHA1
33e81f25493eda3bbf0b7cdcddd523547fa6c31e

SHA256
eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a

SHA512
2632bef55323d9a272e1519e2b2792527d28cbd9fe6a9f9d253e5729978be0de6f36b8e3b2acee70449ba22a33efb41c82c82afe19dad14698b3ada0006ca7fc

Download Submit
C:\Users\Admin\AppData\Roaming\windows_update_513432\client32.exe

Filesize
117KB

MD5
c0eb3eac96511077dafc0afa64c6388c

SHA1
33e81f25493eda3bbf0b7cdcddd523547fa6c31e

SHA256
eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a

SHA512
2632bef55323d9a272e1519e2b2792527d28cbd9fe6a9f9d253e5729978be0de6f36b8e3b2acee70449ba22a33efb41c82c82afe19dad14698b3ada0006ca7fc

Download Submit
C:\Users\Admin\AppData\Roaming\windows_update_513432\client32.ini

Filesize
975B

MD5
e5c15801bc8d2c86279706ac5e853478

SHA1
038d9e76c094e1c00762abbc45b66beebc7f84f4

SHA256
4652713186a5afa6abf4c8765a96de63f92e3ba906dd11a6ab1cfcd55f39fde8

SHA512
0894b9d7fb1dff6f094069e114be6b24f1056cce6e62f3793f2b1cc993a7fa3ac9aa33371efc95e38cb31c36919eeeaacbf4b01b9e25ef553ac0a65828ddf602

Download Submit
C:\Users\Admin\AppData\Roaming\windows_update_513432\msvcr100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Roaming\windows_update_513432\msvcr100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Roaming\windows_update_513432\pcicapi.dll

Filesize
48KB

MD5
d3d2829d36586278c2bcb3f547d6e849

SHA1
72d9fd2397310de717b2bde13ea1483d9eb9af02

SHA256
ae84394ac568c590225d4470ed1a94be94240cbccb3c2b985bdfc4686d8afac8

SHA512
dd16e46e83e455c1b2a1c106926851ad289d5c83c1ee94630ee0457c0793c9a8a7ab3d37d64b978a3c8057ed9eceae2fae56ac97b39b3b5172f8472fbb49973c

Download Submit
C:\Users\Admin\AppData\Roaming\windows_update_513432\pcicapi.dll

Filesize
48KB

MD5
d3d2829d36586278c2bcb3f547d6e849

SHA1
72d9fd2397310de717b2bde13ea1483d9eb9af02

SHA256
ae84394ac568c590225d4470ed1a94be94240cbccb3c2b985bdfc4686d8afac8

SHA512
dd16e46e83e455c1b2a1c106926851ad289d5c83c1ee94630ee0457c0793c9a8a7ab3d37d64b978a3c8057ed9eceae2fae56ac97b39b3b5172f8472fbb49973c

Download Submit
C:\Users\Admin\AppData\Roaming\windows_update_513432\pcichek.dll

Filesize
31KB

MD5
d6fcd63035d9b341c7e165e6e553d3cc

SHA1
3101fef674479b8b63da592d6b8feebfce7fd503

SHA256
265623112eafca985d5acd9db3b5f9e00b39cc1f15cdd5b181d3eb0d413b97de

SHA512
e7136af44c3a69126517046fb36fed38f0c396d2a0a43c00feee3438125b38f91efa6d5e2ba18750924a35431b347f30b71382a9549d24c397f8c5871d50aef3

Download Submit