netsupport | 570c50236f5588d4e12bf9992cac018f4d477a1f65915db5c8eb3be2af08ba64

Analysis

max time kernel
0s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2023, 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

570c50236f5588d4e12bf9992cac018f4d477a1f65915db5c8eb3be2af08ba64.exe
Size

2.1MB
MD5

7862c44fee7e4c821571f55685139063
SHA1

0cd277184838a149724873f423983f32dd853910
SHA256

570c50236f5588d4e12bf9992cac018f4d477a1f65915db5c8eb3be2af08ba64
SHA512

ff58d51c3ec1daa1425297edea45bef43ad45f6bb667380f4f94405851301eac338746f5f103ad53b87fa14b54b6bf84464131209ee194fd6561a02be36ec5ea
SSDEEP

49152:B1UOnVj3g0nSdZ/ufvr7TE22qqpE+OVbbk+LUqxNoWeJqEjXG:BtZ3HSd9ufD+B0Y+IrzqAG

Score

10^/10

netsupport rat

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sistersyndrome.lnk	570c50236f5588d4e12bf9992cac018f4d477a1f65915db5c8eb3be2af08ba64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\570c50236f5588d4e12bf9992cac018f4d477a1f65915db5c8eb3be2af08ba64.exe
"C:\Users\Admin\AppData\Local\Temp\570c50236f5588d4e12bf9992cac018f4d477a1f65915db5c8eb3be2af08ba64.exe"
1⤵
- Drops startup file
PID:1392
- C:\Users\Admin\AppData\Roaming\sistersyndrome\dwemr.exe
  "C:\Users\Admin\AppData\Roaming\sistersyndrome\dwemr.exe"
  2⤵
  PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\sistersyndrome\HTCTL32.DLL

Filesize
320KB

MD5
2d3b207c8a48148296156e5725426c7f

SHA1
ad464eb7cf5c19c8a443ab5b590440b32dbc618f

SHA256
edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

SHA512
55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

Download Submit
C:\Users\Admin\AppData\Roaming\sistersyndrome\HTCTL32.DLL

Filesize
320KB

MD5
2d3b207c8a48148296156e5725426c7f

SHA1
ad464eb7cf5c19c8a443ab5b590440b32dbc618f

SHA256
edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

SHA512
55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

Download Submit
C:\Users\Admin\AppData\Roaming\sistersyndrome\MSVCR100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Roaming\sistersyndrome\NSM.LIC

Filesize
257B

MD5
7067af414215ee4c50bfcd3ea43c84f0

SHA1
c331d410672477844a4ca87f43a14e643c863af9

SHA256
2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12

SHA512
17b888087192bcea9f56128d0950423b1807e294d1c4f953d1bf0f5bd08e5f8e35afeee584ebf9233bfc44e0723db3661911415798159ac118c8a42aaf0b902f

Download Submit
C:\Users\Admin\AppData\Roaming\sistersyndrome\PCICHEK.DLL

Filesize
18KB

MD5
a0b9388c5f18e27266a31f8c5765b263

SHA1
906f7e94f841d464d4da144f7c858fa2160e36db

SHA256
313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

SHA512
6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

Download Submit
C:\Users\Admin\AppData\Roaming\sistersyndrome\PCICL32.DLL

Filesize
2.6MB

MD5
4513192fd22735e5df43fd0de7f8fd97

SHA1
9bddbb1572517aa6db143c643c26098bf66bb16b

SHA256
ae5ce18aa2acd3bc7550dc5871decd48d9d9b76ae691b299887701692ea322e9

SHA512
a3a9cf3a905809cc34869b4ffca9ff210a0666047d4e3ee688402b49554549c0cede1dcae1758597c8fee3dde9807a6da96e08f913792db65cacde65b0008e83

Download Submit
C:\Users\Admin\AppData\Roaming\sistersyndrome\PCICL32.dll

Filesize
3.0MB

MD5
685ed9cce65d82a27b19bddad4ec404a

SHA1
3df963d08c642034d0a460766ab857ca18d01e4c

SHA256
1f866e37d87e69da558b2f9a7e65d66102c2692b7c171fc7a847adac375712c3

SHA512
ffc59195052b04fcf6cd3abd8cff55080bacaa514cbdfb3822f99222a9e0aae2057048e0eb8090efbc3b1f7a6908ee91fda27a8190423da649398668f9e1d9d5

Download Submit
C:\Users\Admin\AppData\Roaming\sistersyndrome\client32.ini

Filesize
666B

MD5
764e9ce66a71417e5c42d0d7b2ec5c38

SHA1
2aee00eb2af7d38961307119318c07e6577b67c8

SHA256
425a5e43deadfe52e05224ed2d2502f90efd42816abafc810a60a50d3bcf450a

SHA512
9716f213bc091e8a4c4967253e6c8e173ef6b518421a05fe1e910eda32983bfefd6605cfd70ee2424f473cb33d01120688a99dc5ea73389b7eb1327edb21d701

Download Submit
C:\Users\Admin\AppData\Roaming\sistersyndrome\dwemr.exe

Filesize
103KB

MD5
8d9709ff7d9c83bd376e01912c734f0a

SHA1
e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294

SHA256
49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3

SHA512
042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee

Download Submit
C:\Users\Admin\AppData\Roaming\sistersyndrome\dwemr.exe

Filesize
103KB

MD5
8d9709ff7d9c83bd376e01912c734f0a

SHA1
e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294

SHA256
49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3

SHA512
042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee

Download Submit
C:\Users\Admin\AppData\Roaming\sistersyndrome\dwemr.exe

Filesize
103KB

MD5
8d9709ff7d9c83bd376e01912c734f0a

SHA1
e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294

SHA256
49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3

SHA512
042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee

Download Submit
C:\Users\Admin\AppData\Roaming\sistersyndrome\msvcr100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Roaming\sistersyndrome\msvcr100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Roaming\sistersyndrome\pcicapi.dll

Filesize
32KB

MD5
dcde2248d19c778a41aa165866dd52d0

SHA1
7ec84be84fe23f0b0093b647538737e1f19ebb03

SHA256
9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

SHA512
c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

Download Submit
C:\Users\Admin\AppData\Roaming\sistersyndrome\pcicapi.dll

Filesize
32KB

MD5
dcde2248d19c778a41aa165866dd52d0

SHA1
7ec84be84fe23f0b0093b647538737e1f19ebb03

SHA256
9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

SHA512
c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

Download Submit
C:\Users\Admin\AppData\Roaming\sistersyndrome\pcichek.dll

Filesize
18KB

MD5
a0b9388c5f18e27266a31f8c5765b263

SHA1
906f7e94f841d464d4da144f7c858fa2160e36db

SHA256
313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

SHA512
6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

Download Submit