netsupport | a41ebd45e9deaf6e493b90e439b4e3845ccad33572333035a9a09ebc890f6a29

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 23:29

Target

2024-05-23_8486c3877613098f3b764f579d56c92d_mafia.exe
Size

919KB
MD5

8486c3877613098f3b764f579d56c92d
SHA1

66de769496bef71b5de0ce68d5e22a11dfc2f584
SHA256

a41ebd45e9deaf6e493b90e439b4e3845ccad33572333035a9a09ebc890f6a29
SHA512

34af135cab24eaa6c80a26abf27935e1eeb18f08075e5400d6684a03233d7e3ff454fef0028091f851a8f6d7594fee8ae00ec056df55d831a0c5fb9acbe81821
SSDEEP

24576:cY6mzRruIgLI6Y8Y/+ie9+DPBWeJktfqgt+:cYBRruIgLIz8Y/+Gngt+

Score

10^/10

netsupport rat

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\quartz.pdb	2024-05-23_8486c3877613098f3b764f579d56c92d_mafia.exe
File opened for modification	C:\Windows\SysWOW64\TextShaping.pdb	2024-05-23_8486c3877613098f3b764f579d56c92d_mafia.exe
File opened for modification	C:\Windows\SysWOW64\apphelp.pdb	2024-05-23_8486c3877613098f3b764f579d56c92d_mafia.exe
File opened for modification	C:\Windows\SysWOW64\wkernel32.pdb	2024-05-23_8486c3877613098f3b764f579d56c92d_mafia.exe
File opened for modification	C:\Windows\SysWOW64\wntdll.pdb	2024-05-23_8486c3877613098f3b764f579d56c92d_mafia.exe
File opened for modification	C:\Windows\SysWOW64\wgdi32full.pdb	2024-05-23_8486c3877613098f3b764f579d56c92d_mafia.exe
File opened for modification	C:\Windows\SysWOW64\Windows.Storage.pdb	2024-05-23_8486c3877613098f3b764f579d56c92d_mafia.exe
File opened for modification	C:\Windows\SysWOW64\wkernelbase.pdb	2024-05-23_8486c3877613098f3b764f579d56c92d_mafia.exe
File opened for modification	C:\Windows\SysWOW64\combase.pdb	2024-05-23_8486c3877613098f3b764f579d56c92d_mafia.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.1288_none_d9539a9fe102720c\gdiplus.pdb	2024-05-23_8486c3877613098f3b764f579d56c92d_mafia.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2332	2024-05-23_8486c3877613098f3b764f579d56c92d_mafia.exe
2332	2024-05-23_8486c3877613098f3b764f579d56c92d_mafia.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4312