netsupport | 5bf35e96c9fc4cb60755ea27f9a53e5c7d7ace74ea515e146c28a750f49f81e9

Analysis

max time kernel
27s
max time network
127s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-03-2023 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe
Size

2.5MB
MD5

5331532e760e8d1006f09ab8be38efe4
SHA1

09bbc125d5e7fba8bfbd1c26b71c7f0496b7e574
SHA256

b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041
SHA512

9402a6c1f9c79b0e47b908c8b86dbd52f71d15099bdd80bc1c9971fa4fdad79778bcfba0b9112cb1fc0dd15ca9a9fe419780f3ac456c0ac0b304d1b2ea9f057c
SSDEEP

49152:xFeJD6gLQsN5kEtXhd9Gvf6Hgx6nlhXesKb40lKSm8:GD95kEtP9Gvf6AO5IMMKu

Score

10^/10

netsupport rat

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Drops startup file 1 IoCs

Processes:

b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autorunn2023.ini.lnk	b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe

Executes dropped EXE 1 IoCs

Processes:

client32.exe

pid process

832 client32.exe

pid	process
832	client32.exe

Loads dropped DLL 10 IoCs

Processes:

b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.execlient32.exe

pid	process
1688	b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe
1688	b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe
1688	b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe
1688	b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe
1688	b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe
832	client32.exe
832	client32.exe
832	client32.exe
832	client32.exe
832	client32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

client32.exe

description pid process

Token: SeSecurityPrivilege 832 client32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

client32.exe

pid process

832 client32.exe

description	pid	process
Token: SeSecurityPrivilege	832	client32.exe

pid	process
832	client32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe

description	pid	process	target process
PID 1688 wrote to memory of 832	1688	b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe	client32.exe
PID 1688 wrote to memory of 832	1688	b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe	client32.exe
PID 1688 wrote to memory of 832	1688	b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe	client32.exe
PID 1688 wrote to memory of 832	1688	b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe	client32.exe
PID 1688 wrote to memory of 832	1688	b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe	client32.exe
PID 1688 wrote to memory of 832	1688	b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe	client32.exe
PID 1688 wrote to memory of 832	1688	b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe	client32.exe

C:\Users\Admin\AppData\Local\Temp\b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe
"C:\Users\Admin\AppData\Local\Temp\b4e0ddcf69631a6f24718c6a25ef4eee2c13d56a581ec4f102e9388b39bfb041.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Admin\AppData\Roaming\supwinupdate\client32.exe
"C:\Users\Admin\AppData\Roaming\supwinupdate\client32.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\supwinupdate\HTCTL32.DLL
Filesize
299KB

MD5
369388ac78ca4ca8a64219cf9aafad4c

SHA1
dfa6c01c55ac799f041c65df9a35aba8cf0d8c2d

SHA256
c76ee648639406c81469772311c39b46042bf1b91e47d9201908f3cf70407f30

SHA512
7d090f033ffc48b870d692877f3804a69dcb1ff61b96936f1ab77bf42b156839bfd787c387bc7d642c732868e3dcd8c0ff3b319f057c0157b5afc6843b302bc5

Download Submit
C:\Users\Admin\AppData\Roaming\supwinupdate\MSVCR100.dll
Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Roaming\supwinupdate\NSM.LIC
Filesize
258B

MD5
06fa55f6114fd4155223638237dc4b1d

SHA1
a7662e7466cfa9ab554f68bb679c2807e6d3afad

SHA256
e8fea18a30729f9a3b56460964d9e9f74a7075732cf7a522456280903ddd9cf7

SHA512
df5b984a9ae7a65c7213328c14c172296a79af5079a035d7b4e77c55c80856eebcb58c8436fc2b5c33b08dd81a7d646eb0829d41e7a45c4e45039aea5574bf5e

Download Submit
C:\Users\Admin\AppData\Roaming\supwinupdate\PCICAPI.dll
Filesize
100KB

MD5
f0d7d2a77eee2b3146405d3ad0d56230

SHA1
37c323faf58584606ee5847cb9a25346c588f78f

SHA256
f043653ab1b8fbe5a33922df5b4fb46797e9694e5fcee807b97cc6aaef650131

SHA512
861258b5b97665f649437fd25aadc5dc66e5bc5a87d7482300f9931810f0d89d0ed9c01890cd038daa7c6d2f1850a3208fc20b3c1dc2e588c7688e228a4baade

Download Submit
C:\Users\Admin\AppData\Roaming\supwinupdate\PCICL32.dll
Filesize
3.3MB

MD5
1274cca13cc5e37ca94d35e5b0673e89

SHA1
a8754c94f88273c304bc45a5afd61a383bb52117

SHA256
cd5510c8bc7ea60be77ad4aab502ee02d871bf4e917aeeb6921c20eebd9693dd

SHA512
52eafa31ee942dc92d0b8f52c12206f6abc1d5fae799b37b371e97c38ce66bd0693263de86b4880748ba1405054701288caf2cd00cd327edc164e1390cf9191c

Download Submit
C:\Users\Admin\AppData\Roaming\supwinupdate\client32.exe
Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
C:\Users\Admin\AppData\Roaming\supwinupdate\client32.exe
Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
C:\Users\Admin\AppData\Roaming\supwinupdate\client32.ini
Filesize
1009B

MD5
95bfe0d689147edf522ccbc7b62f6400

SHA1
633a14f96e2b022fb1e05e4d5308b49f9439405c

SHA256
2949b1bc32a6572c854f1185084d2f9f252e86c0ead6f15e3716b24ba1147b85

SHA512
788064d17b897f70f3bf7cd474266d6d307600184628341c1863c129bff46e74a4f3f833f2ab5bfaa0b15a462efb5fbafb01f136f18a4611259cb4c7236709ad

Download Submit
C:\Users\Admin\AppData\Roaming\supwinupdate\pcichek.dll
Filesize
8KB

MD5
07b474ab5c503f35873b94cd48d01592

SHA1
e6f699d6c021d9d434cc6a4e68516c4c2ac80ddc

SHA256
c8911c298f860de85037f8634e8539627f5a1c13b1fffe5568d63612e29b9cd4

SHA512
a995b0d1fba6e99dd89afbf5161efc18b0268c001c27155876e642abc8639f79c2c320530039cfa5ec9f6ca10e1d716060b0fb86414245f578f920f11c9bbbc8

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\HTCTL32.DLL
Filesize
299KB

MD5
369388ac78ca4ca8a64219cf9aafad4c

SHA1
dfa6c01c55ac799f041c65df9a35aba8cf0d8c2d

SHA256
c76ee648639406c81469772311c39b46042bf1b91e47d9201908f3cf70407f30

SHA512
7d090f033ffc48b870d692877f3804a69dcb1ff61b96936f1ab77bf42b156839bfd787c387bc7d642c732868e3dcd8c0ff3b319f057c0157b5afc6843b302bc5

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\PCICHEK.DLL
Filesize
8KB

MD5
07b474ab5c503f35873b94cd48d01592

SHA1
e6f699d6c021d9d434cc6a4e68516c4c2ac80ddc

SHA256
c8911c298f860de85037f8634e8539627f5a1c13b1fffe5568d63612e29b9cd4

SHA512
a995b0d1fba6e99dd89afbf5161efc18b0268c001c27155876e642abc8639f79c2c320530039cfa5ec9f6ca10e1d716060b0fb86414245f578f920f11c9bbbc8

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\PCICL32.DLL
Filesize
3.3MB

MD5
1274cca13cc5e37ca94d35e5b0673e89

SHA1
a8754c94f88273c304bc45a5afd61a383bb52117

SHA256
cd5510c8bc7ea60be77ad4aab502ee02d871bf4e917aeeb6921c20eebd9693dd

SHA512
52eafa31ee942dc92d0b8f52c12206f6abc1d5fae799b37b371e97c38ce66bd0693263de86b4880748ba1405054701288caf2cd00cd327edc164e1390cf9191c

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\client32.exe
Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\client32.exe
Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\client32.exe
Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\client32.exe
Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\client32.exe
Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\msvcr100.dll
Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\pcicapi.dll
Filesize
100KB

MD5
f0d7d2a77eee2b3146405d3ad0d56230

SHA1
37c323faf58584606ee5847cb9a25346c588f78f

SHA256
f043653ab1b8fbe5a33922df5b4fb46797e9694e5fcee807b97cc6aaef650131

SHA512
861258b5b97665f649437fd25aadc5dc66e5bc5a87d7482300f9931810f0d89d0ed9c01890cd038daa7c6d2f1850a3208fc20b3c1dc2e588c7688e228a4baade

Download Submit