Extracted

Extracted

• • Target

    http://adclick.g.doubleclick.net/aclk?sa=L&ai=BqJtdBWxAU4nHJ4ip-wbk_4GICtyYktUEAAAAEAEgjKnsHTgAWLSxtaqWAWCZhoCA9CGyARZndW5kZW0ubWlsbGl5ZXQuY29tLnRyugEJZ2ZwX2ltYWdlyAEJ2gFYaHR0cDovL2d1bmRlbS5taWxsaXlldC5jb20udHIvMy1rb3BydS12aXlhZHVndW5kZS1nb2N1ay9ndW5kZW0vZGV0YXkvMTg2MjcyOC9kZWZhdWx0Lmh0bakCtlPlsBi_nz7AAgLgAgDqAjMvMTI4MDcwNjYwL01pbGxpeWV0X0d1bmRlbS9NaWxsaXlldF9HdW5kZW1fcGFnZXNraW74AvTRHoADAZADhAeYA4QHqAMB4AQBoAYf&num=0&sig=AOD64_1_qXBCwExb-oj6QlJ28w160fH3jQ&client=ca-pub-5526484441315121&adurl=%2F%2F%2Fgg.gg%2Fcarzzz%23mWXikzW

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1