netsupport | b6526c5fe65b1eee59b6c9c44da572748f0ef22427e3d331a7a5d14111845771

Analysis

max time kernel
29s
max time network
137s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-03-2023 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.exe
Size

2.5MB
MD5

4cc1911165a8f68dd066502c3fb6fe9a
SHA1

d8f988c5a6a3b9957c53bce3f5a0fe1c8fc618e1
SHA256

c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af
SHA512

49346e0a6478abc41c0f186b430304c6059573830d68161868b777dab96b67175a19d05b738852d35ec6ccf4a594a3441a1641ba3e25f15874edad9d9be41a2e
SSDEEP

49152:jsOTd0VUXdCBTQsmARXBvK4DMitfle7+xaFWg067EcSUCFfw0:EGYnXZK44ilYFWg0HcSdFY0

Score

10^/10

netsupport rat

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Drops startup file 1 IoCs

Processes:

c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autorunns12.ini.lnk	c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.exe

Executes dropped EXE 1 IoCs

Processes:

client32.exe

pid process

524 client32.exe

pid	process
524	client32.exe

Loads dropped DLL 9 IoCs

Processes:

c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.execlient32.exe

pid	process
1616	c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.exe
1616	c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.exe
1616	c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.exe
1616	c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.exe
524	client32.exe
524	client32.exe
524	client32.exe
524	client32.exe
524	client32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

client32.exe

description pid process

Token: SeSecurityPrivilege 524 client32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

client32.exe

pid process

524 client32.exe

description	pid	process
Token: SeSecurityPrivilege	524	client32.exe

pid	process
524	client32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.exe

description	pid	process	target process
PID 1616 wrote to memory of 524	1616	c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.exe	client32.exe
PID 1616 wrote to memory of 524	1616	c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.exe	client32.exe
PID 1616 wrote to memory of 524	1616	c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.exe	client32.exe
PID 1616 wrote to memory of 524	1616	c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.exe	client32.exe
PID 1616 wrote to memory of 524	1616	c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.exe	client32.exe
PID 1616 wrote to memory of 524	1616	c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.exe	client32.exe
PID 1616 wrote to memory of 524	1616	c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.exe	client32.exe

C:\Users\Admin\AppData\Local\Temp\c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.exe
"C:\Users\Admin\AppData\Local\Temp\c3dfec759e0e2c8c5b9c57ae941ec7e0fe902bb5eb3ac9c44b47296bbc66f8af.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616

C:\Users\Admin\AppData\Roaming\UpdatSupp1443\client32.exe
"C:\Users\Admin\AppData\Roaming\UpdatSupp1443\client32.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\UpdatSupp1443\HTCTL32.DLL

Filesize
320KB

MD5
c94005d2dcd2a54e40510344e0bb9435

SHA1
55b4a1620c5d0113811242c20bd9870a1e31d542

SHA256
3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899

SHA512
2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

Download Submit
C:\Users\Admin\AppData\Roaming\UpdatSupp1443\MSVCR100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Roaming\UpdatSupp1443\NSM.LIC

Filesize
259B

MD5
6b5215aa2cf4128127b390c5bcb90ce7

SHA1
100b116bae562f066f61cc5f0b339d466f90e0ff

SHA256
99dfc0b55bf27abc581f37c914ed0ca0522ad9f9685b3e4f73079e87ebbdbcba

SHA512
98ce6521c46880ee8e98796fc4e712f9e858201ca89a352884d7b0325b43d6e2de2c0a87ba504db5c9409aa699e91e26e616e285e26543388c6395696b6daa5c

Download Submit
C:\Users\Admin\AppData\Roaming\UpdatSupp1443\PCICL32.dll

Filesize
3.6MB

MD5
d3d39180e85700f72aaae25e40c125ff

SHA1
f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15

SHA256
38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5

SHA512
471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f

Download Submit
C:\Users\Admin\AppData\Roaming\UpdatSupp1443\client32.exe

Filesize
117KB

MD5
c0eb3eac96511077dafc0afa64c6388c

SHA1
33e81f25493eda3bbf0b7cdcddd523547fa6c31e

SHA256
eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a

SHA512
2632bef55323d9a272e1519e2b2792527d28cbd9fe6a9f9d253e5729978be0de6f36b8e3b2acee70449ba22a33efb41c82c82afe19dad14698b3ada0006ca7fc

Download Submit
C:\Users\Admin\AppData\Roaming\UpdatSupp1443\client32.exe

Filesize
117KB

MD5
c0eb3eac96511077dafc0afa64c6388c

SHA1
33e81f25493eda3bbf0b7cdcddd523547fa6c31e

SHA256
eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a

SHA512
2632bef55323d9a272e1519e2b2792527d28cbd9fe6a9f9d253e5729978be0de6f36b8e3b2acee70449ba22a33efb41c82c82afe19dad14698b3ada0006ca7fc

Download Submit
C:\Users\Admin\AppData\Roaming\UpdatSupp1443\client32.ini

Filesize
970B

MD5
cb06bb1ae473b3420d19edd2eb6dd078

SHA1
2110d6370b4838c027693b0f9bba7e5620bf0517

SHA256
e61420ed7025143cace025adbf0290130fa4fac23e4662c7fbbe3160b899e2ac

SHA512
c8015c5e8c6000c60f94f413ab3dab8b7d7215998a0ae751c5ea886e7732e5dacafbd8ece4d7f485f8480274e2dcbce4e53eafec196a4c515c405654b7cd623f

Download Submit
C:\Users\Admin\AppData\Roaming\UpdatSupp1443\pcicapi.dll

Filesize
48KB

MD5
d3d2829d36586278c2bcb3f547d6e849

SHA1
72d9fd2397310de717b2bde13ea1483d9eb9af02

SHA256
ae84394ac568c590225d4470ed1a94be94240cbccb3c2b985bdfc4686d8afac8

SHA512
dd16e46e83e455c1b2a1c106926851ad289d5c83c1ee94630ee0457c0793c9a8a7ab3d37d64b978a3c8057ed9eceae2fae56ac97b39b3b5172f8472fbb49973c

Download Submit
C:\Users\Admin\AppData\Roaming\UpdatSupp1443\pcichek.dll

Filesize
31KB

MD5
d6fcd63035d9b341c7e165e6e553d3cc

SHA1
3101fef674479b8b63da592d6b8feebfce7fd503

SHA256
265623112eafca985d5acd9db3b5f9e00b39cc1f15cdd5b181d3eb0d413b97de

SHA512
e7136af44c3a69126517046fb36fed38f0c396d2a0a43c00feee3438125b38f91efa6d5e2ba18750924a35431b347f30b71382a9549d24c397f8c5871d50aef3

Download Submit
\Users\Admin\AppData\Roaming\UpdatSupp1443\HTCTL32.DLL

Filesize
320KB

MD5
c94005d2dcd2a54e40510344e0bb9435

SHA1
55b4a1620c5d0113811242c20bd9870a1e31d542

SHA256
3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899

SHA512
2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

Download Submit
\Users\Admin\AppData\Roaming\UpdatSupp1443\PCICHEK.DLL

Filesize
31KB

MD5
d6fcd63035d9b341c7e165e6e553d3cc

SHA1
3101fef674479b8b63da592d6b8feebfce7fd503

SHA256
265623112eafca985d5acd9db3b5f9e00b39cc1f15cdd5b181d3eb0d413b97de

SHA512
e7136af44c3a69126517046fb36fed38f0c396d2a0a43c00feee3438125b38f91efa6d5e2ba18750924a35431b347f30b71382a9549d24c397f8c5871d50aef3

Download Submit
\Users\Admin\AppData\Roaming\UpdatSupp1443\PCICL32.DLL

Filesize
3.6MB

MD5
d3d39180e85700f72aaae25e40c125ff

SHA1
f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15

SHA256
38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5

SHA512
471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f

Download Submit
\Users\Admin\AppData\Roaming\UpdatSupp1443\client32.exe

Filesize
117KB

MD5
c0eb3eac96511077dafc0afa64c6388c

SHA1
33e81f25493eda3bbf0b7cdcddd523547fa6c31e

SHA256
eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a

SHA512
2632bef55323d9a272e1519e2b2792527d28cbd9fe6a9f9d253e5729978be0de6f36b8e3b2acee70449ba22a33efb41c82c82afe19dad14698b3ada0006ca7fc

Download Submit
\Users\Admin\AppData\Roaming\UpdatSupp1443\client32.exe

Filesize
117KB

MD5
c0eb3eac96511077dafc0afa64c6388c

SHA1
33e81f25493eda3bbf0b7cdcddd523547fa6c31e

SHA256
eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a

SHA512
2632bef55323d9a272e1519e2b2792527d28cbd9fe6a9f9d253e5729978be0de6f36b8e3b2acee70449ba22a33efb41c82c82afe19dad14698b3ada0006ca7fc

Download Submit
\Users\Admin\AppData\Roaming\UpdatSupp1443\client32.exe

Filesize
117KB

MD5
c0eb3eac96511077dafc0afa64c6388c

SHA1
33e81f25493eda3bbf0b7cdcddd523547fa6c31e

SHA256
eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a

SHA512
2632bef55323d9a272e1519e2b2792527d28cbd9fe6a9f9d253e5729978be0de6f36b8e3b2acee70449ba22a33efb41c82c82afe19dad14698b3ada0006ca7fc

Download Submit
\Users\Admin\AppData\Roaming\UpdatSupp1443\client32.exe

Filesize
117KB

MD5
c0eb3eac96511077dafc0afa64c6388c

SHA1
33e81f25493eda3bbf0b7cdcddd523547fa6c31e

SHA256
eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a

SHA512
2632bef55323d9a272e1519e2b2792527d28cbd9fe6a9f9d253e5729978be0de6f36b8e3b2acee70449ba22a33efb41c82c82afe19dad14698b3ada0006ca7fc

Download Submit
\Users\Admin\AppData\Roaming\UpdatSupp1443\msvcr100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
\Users\Admin\AppData\Roaming\UpdatSupp1443\pcicapi.dll

Filesize
48KB

MD5
d3d2829d36586278c2bcb3f547d6e849

SHA1
72d9fd2397310de717b2bde13ea1483d9eb9af02

SHA256
ae84394ac568c590225d4470ed1a94be94240cbccb3c2b985bdfc4686d8afac8

SHA512
dd16e46e83e455c1b2a1c106926851ad289d5c83c1ee94630ee0457c0793c9a8a7ab3d37d64b978a3c8057ed9eceae2fae56ac97b39b3b5172f8472fbb49973c

Download Submit