netsupport | 7d5dae122c94dc0dc1b1c15b014cc3c76bf14430346b9fa98b2b4c97d7c9b1fd

Analysis

max time kernel
140s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 14:36

Target

2024-04-09_efff68414f063edfebf725ffe970fc0e_mafia.exe
Size

3.0MB
MD5

efff68414f063edfebf725ffe970fc0e
SHA1

42a23880762033a792bbba4f572e6140e0e7273a
SHA256

7d5dae122c94dc0dc1b1c15b014cc3c76bf14430346b9fa98b2b4c97d7c9b1fd
SHA512

49f3796772455fcd1db1a314face091219cd2a50b5e43769b38da27666da1575a24d8f71440ff91380b5a6626b2e295599ce70d431103263db35689db18b65a6
SSDEEP

24576:iUrkVwpQWecZyhfG+SvDZioocsygYhFFa0UwekqcRkh9aLY:1rkOpZeHfG+S7Z3o/ygYhFl96cRkh9uY

Score

10^/10

netsupport rat

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1300	4700	WerFault.exe	93
4220	4700	WerFault.exe	93
4592	4700	WerFault.exe	93

C:\Users\Admin\AppData\Local\Temp\2024-04-09_efff68414f063edfebf725ffe970fc0e_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-09_efff68414f063edfebf725ffe970fc0e_mafia.exe"
1⤵
PID:4700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 916
  2⤵
  - Program crash
  PID:1300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 904
  2⤵
  - Program crash
  PID:4220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 960
  2⤵
  - Program crash
  PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4700 -ip 4700
1⤵
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4700 -ip 4700
1⤵
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4700 -ip 4700
1⤵
PID:3872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:1860