netsupport | c8449615cbbd5105e7894fdca6c5e9b278ce7692a0af96d4540c332df49b8eb2

Analysis

max time kernel
38s
max time network
98s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-03-2023 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

C8449615CBBD5105E7894FDCA6C5E9B278CE7692A0AF9.exe
Size

2.7MB
MD5

bf544c611cfb3d368804c5d30a7f5308
SHA1

fb18778b66c54bcc0f1390acdcfacaf8da320215
SHA256

c8449615cbbd5105e7894fdca6c5e9b278ce7692a0af96d4540c332df49b8eb2
SHA512

9fd561729ea6493ac3b739cd4aea72a3c3b97765db4fc05e2278012d69d39dabfa4bfc35d1a0a44291c3e64836999a0716fed612f0dc0ce540583fa75d5822d8
SSDEEP

49152:SKINhiFm5Dz8twrCSzcB5ALEgFigntylPIVQgD0m2w2d+C3gLh4n2:agA5ktwrBzcPtYslPp+0fd+C3gt

Score

10^/10

netsupport persistence rat

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport
Drops startup file 1 IoCs

Processes:

netclientovl.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client32.lnk netclientovl.exe
Executes dropped EXE 2 IoCs

Processes:

netclientovl.execlient32.exe

pid process

848 netclientovl.exe
1748 client32.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client32.lnk	netclientovl.exe

Loads dropped DLL 11 IoCs

Processes:

netclientovl.execlient32.exe

pid	process
848	netclientovl.exe
848	netclientovl.exe
848	netclientovl.exe
848	netclientovl.exe
848	netclientovl.exe
1748	client32.exe
1748	client32.exe
1748	client32.exe
1748	client32.exe
1748	client32.exe
1748	client32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

C8449615CBBD5105E7894FDCA6C5E9B278CE7692A0AF9.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	C8449615CBBD5105E7894FDCA6C5E9B278CE7692A0AF9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	C8449615CBBD5105E7894FDCA6C5E9B278CE7692A0AF9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

client32.exe

description pid process

Token: SeSecurityPrivilege 1748 client32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

client32.exe

pid process

1748 client32.exe

description	pid	process
Token: SeSecurityPrivilege	1748	client32.exe

pid	process
1748	client32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

C8449615CBBD5105E7894FDCA6C5E9B278CE7692A0AF9.exenetclientovl.exe

description	pid	process	target process
PID 1408 wrote to memory of 848	1408	C8449615CBBD5105E7894FDCA6C5E9B278CE7692A0AF9.exe	netclientovl.exe
PID 1408 wrote to memory of 848	1408	C8449615CBBD5105E7894FDCA6C5E9B278CE7692A0AF9.exe	netclientovl.exe
PID 1408 wrote to memory of 848	1408	C8449615CBBD5105E7894FDCA6C5E9B278CE7692A0AF9.exe	netclientovl.exe
PID 1408 wrote to memory of 848	1408	C8449615CBBD5105E7894FDCA6C5E9B278CE7692A0AF9.exe	netclientovl.exe
PID 848 wrote to memory of 1748	848	netclientovl.exe	client32.exe
PID 848 wrote to memory of 1748	848	netclientovl.exe	client32.exe
PID 848 wrote to memory of 1748	848	netclientovl.exe	client32.exe
PID 848 wrote to memory of 1748	848	netclientovl.exe	client32.exe

C:\Users\Admin\AppData\Local\Temp\C8449615CBBD5105E7894FDCA6C5E9B278CE7692A0AF9.exe
"C:\Users\Admin\AppData\Local\Temp\C8449615CBBD5105E7894FDCA6C5E9B278CE7692A0AF9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1408

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\netclientovl.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\netclientovl.exe
2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:848

C:\Users\Admin\AppData\Roaming\NetClient\client32.exe
"C:\Users\Admin\AppData\Roaming\NetClient\client32.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\netclientovl.exe
Filesize
383.7MB

MD5
ed947d43f2bbbe9f939733303830797f

SHA1
18befd147602da11d859dcfc6cb5a259df9df752

SHA256
5e7804668a66bd101b37b3e2d512c0398bfa6d39d1fa256acf927533c8e8242e

SHA512
8344e8d0be3d46f97e59bc10543c472d890a15c9a4ba175029f6c3711d4e18f10c0a3c0fb46fbb8a8577906ee44188c1e9d9f0b5949161ea4343421ca1485f41

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\netclientovl.exe
Filesize
383.7MB

MD5
ed947d43f2bbbe9f939733303830797f

SHA1
18befd147602da11d859dcfc6cb5a259df9df752

SHA256
5e7804668a66bd101b37b3e2d512c0398bfa6d39d1fa256acf927533c8e8242e

SHA512
8344e8d0be3d46f97e59bc10543c472d890a15c9a4ba175029f6c3711d4e18f10c0a3c0fb46fbb8a8577906ee44188c1e9d9f0b5949161ea4343421ca1485f41

Download Submit
C:\Users\Admin\AppData\Roaming\NetClient\HTCTL32.DLL
Filesize
320KB

MD5
2d3b207c8a48148296156e5725426c7f

SHA1
ad464eb7cf5c19c8a443ab5b590440b32dbc618f

SHA256
edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

SHA512
55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

Download Submit
C:\Users\Admin\AppData\Roaming\NetClient\MSVCR100.dll
Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Roaming\NetClient\NSM.LIC
Filesize
257B

MD5
7067af414215ee4c50bfcd3ea43c84f0

SHA1
c331d410672477844a4ca87f43a14e643c863af9

SHA256
2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12

SHA512
17b888087192bcea9f56128d0950423b1807e294d1c4f953d1bf0f5bd08e5f8e35afeee584ebf9233bfc44e0723db3661911415798159ac118c8a42aaf0b902f

Download Submit
C:\Users\Admin\AppData\Roaming\NetClient\PCICL32.dll
Filesize
3.6MB

MD5
00587238d16012152c2e951a087f2cc9

SHA1
c4e27a43075ce993ff6bb033360af386b2fc58ff

SHA256
63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8

SHA512
637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226

Download Submit
C:\Users\Admin\AppData\Roaming\NetClient\TCCTL32.DLL
Filesize
387KB

MD5
eab603d12705752e3d268d86dff74ed4

SHA1
01873977c871d3346d795cf7e3888685de9f0b16

SHA256
6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea

SHA512
77de0d9c93ccba967db70b280a85a770b3d8bea3b707b1abb037b2826b48898fec87924e1a6cce218c43478e5209e9eb9781051b4c3b450bea3cd27dbd32c7f3

Download Submit
C:\Users\Admin\AppData\Roaming\NetClient\client32.exe
Filesize
103KB

MD5
8d9709ff7d9c83bd376e01912c734f0a

SHA1
e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294

SHA256
49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3

SHA512
042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee

Download Submit
C:\Users\Admin\AppData\Roaming\NetClient\client32.exe
Filesize
103KB

MD5
8d9709ff7d9c83bd376e01912c734f0a

SHA1
e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294

SHA256
49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3

SHA512
042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee

Download Submit
C:\Users\Admin\AppData\Roaming\NetClient\client32.ini
Filesize
605B

MD5
76089405fb32e8fe872b43e433d55d16

SHA1
5ef42be54309b939b9c84a4971199f6467eb5c4c

SHA256
236ab872d2b28199930777ac3e63e45039bcdafbab3ba5b2b0576537d9d92065

SHA512
c6f99c0e107b36792e23d8ec3309f8de42bd5b53d11ffb6fb282d255bff4b13be43644c96806f240628a45f7687291ae68d0d382c3b6fce58bbdde2174bd2e7a

Download Submit
C:\Users\Admin\AppData\Roaming\NetClient\pcicapi.dll
Filesize
32KB

MD5
dcde2248d19c778a41aa165866dd52d0

SHA1
7ec84be84fe23f0b0093b647538737e1f19ebb03

SHA256
9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

SHA512
c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

Download Submit
C:\Users\Admin\AppData\Roaming\NetClient\pcichek.dll
Filesize
18KB

MD5
a0b9388c5f18e27266a31f8c5765b263

SHA1
906f7e94f841d464d4da144f7c858fa2160e36db

SHA256
313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

SHA512
6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

Download Submit
\Users\Admin\AppData\Roaming\NetClient\HTCTL32.DLL
Filesize
320KB

MD5
2d3b207c8a48148296156e5725426c7f

SHA1
ad464eb7cf5c19c8a443ab5b590440b32dbc618f

SHA256
edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

SHA512
55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

Download Submit
\Users\Admin\AppData\Roaming\NetClient\PCICHEK.DLL
Filesize
18KB

MD5
a0b9388c5f18e27266a31f8c5765b263

SHA1
906f7e94f841d464d4da144f7c858fa2160e36db

SHA256
313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

SHA512
6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

Download Submit
\Users\Admin\AppData\Roaming\NetClient\PCICL32.DLL
Filesize
3.6MB

MD5
00587238d16012152c2e951a087f2cc9

SHA1
c4e27a43075ce993ff6bb033360af386b2fc58ff

SHA256
63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8

SHA512
637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226

Download Submit
\Users\Admin\AppData\Roaming\NetClient\TCCTL32.DLL
Filesize
387KB

MD5
eab603d12705752e3d268d86dff74ed4

SHA1
01873977c871d3346d795cf7e3888685de9f0b16

SHA256
6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea

SHA512
77de0d9c93ccba967db70b280a85a770b3d8bea3b707b1abb037b2826b48898fec87924e1a6cce218c43478e5209e9eb9781051b4c3b450bea3cd27dbd32c7f3

Download Submit
\Users\Admin\AppData\Roaming\NetClient\client32.exe
Filesize
103KB

MD5
8d9709ff7d9c83bd376e01912c734f0a

SHA1
e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294

SHA256
49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3

SHA512
042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee

Download Submit
\Users\Admin\AppData\Roaming\NetClient\client32.exe
Filesize
103KB

MD5
8d9709ff7d9c83bd376e01912c734f0a

SHA1
e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294

SHA256
49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3

SHA512
042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee

Download Submit
\Users\Admin\AppData\Roaming\NetClient\client32.exe
Filesize
103KB

MD5
8d9709ff7d9c83bd376e01912c734f0a

SHA1
e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294

SHA256
49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3

SHA512
042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee

Download Submit
\Users\Admin\AppData\Roaming\NetClient\client32.exe
Filesize
103KB

MD5
8d9709ff7d9c83bd376e01912c734f0a

SHA1
e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294

SHA256
49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3

SHA512
042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee

Download Submit
\Users\Admin\AppData\Roaming\NetClient\client32.exe
Filesize
103KB

MD5
8d9709ff7d9c83bd376e01912c734f0a

SHA1
e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294

SHA256
49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3

SHA512
042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee

Download Submit
\Users\Admin\AppData\Roaming\NetClient\msvcr100.dll
Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
\Users\Admin\AppData\Roaming\NetClient\pcicapi.dll
Filesize
32KB

MD5
dcde2248d19c778a41aa165866dd52d0

SHA1
7ec84be84fe23f0b0093b647538737e1f19ebb03

SHA256
9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

SHA512
c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

Download Submit