netsupport | fb3a162f90596dad016f845760a11a15415d09d4b46289eb81f30f550ef83544 | Triage

Analysis

max time kernel
1170s
max time network
1188s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 18:52

Sharing

Report Analysis Logs

General

Target

Advanced_IP_Scanner_2.5.4594.1.exe
Size

1.5MB
MD5

da9584768f8ab97ad015ab14df3428de
SHA1

b8b664bd84744ffe30826d10ad6bb986a4a9418b
SHA256

fb3a162f90596dad016f845760a11a15415d09d4b46289eb81f30f550ef83544
SHA512

2ce68c4a9dc72280cbc8231529d975006a674422e25e51edfec3b156623606596cd959fde2d4bc91bef0251630fbebd604f2587d4f4f8e861776c754b35f4fad
SSDEEP

24576:a9Yu8GgnSR7uT7O8qGVniQjY2nyZlEe+NB4HNoP8Bw/F3cjtBxVTNbpM7Z3af53G:ZGMK7qPVFjY2nyZSNB4t48sUjbpcZ3eG

Score

10^/10

netsupport rat

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	Advanced_IP_Scanner_2.5.4594.1.exe

Executes dropped EXE 3 IoCs

pid	Process
468	client32.exe
1864	Advanced_Port_Scanner_2.5.3869.exe
2680	Advanced_Port_Scanner_2.5.3869.tmp

Loads dropped DLL 7 IoCs

pid	Process
468	client32.exe
468	client32.exe
468	client32.exe
468	client32.exe
468	client32.exe
468	client32.exe
2680	Advanced_Port_Scanner_2.5.3869.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

pid	Process
4532	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	468	client32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
468	client32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 4532	2184	Advanced_IP_Scanner_2.5.4594.1.exe	89
PID 2184 wrote to memory of 4532	2184	Advanced_IP_Scanner_2.5.4594.1.exe	89
PID 2184 wrote to memory of 4532	2184	Advanced_IP_Scanner_2.5.4594.1.exe	89
PID 2184 wrote to memory of 468	2184	Advanced_IP_Scanner_2.5.4594.1.exe	90
PID 2184 wrote to memory of 468	2184	Advanced_IP_Scanner_2.5.4594.1.exe	90
PID 2184 wrote to memory of 468	2184	Advanced_IP_Scanner_2.5.4594.1.exe	90
PID 2184 wrote to memory of 1864	2184	Advanced_IP_Scanner_2.5.4594.1.exe	92
PID 2184 wrote to memory of 1864	2184	Advanced_IP_Scanner_2.5.4594.1.exe	92
PID 2184 wrote to memory of 1864	2184	Advanced_IP_Scanner_2.5.4594.1.exe	92
PID 1864 wrote to memory of 2680	1864	Advanced_Port_Scanner_2.5.3869.exe	93
PID 1864 wrote to memory of 2680	1864	Advanced_Port_Scanner_2.5.3869.exe	93
PID 1864 wrote to memory of 2680	1864	Advanced_Port_Scanner_2.5.3869.exe	93

C:\Users\Admin\AppData\Local\Temp\Advanced_IP_Scanner_2.5.4594.1.exe
"C:\Users\Admin\AppData\Local\Temp\Advanced_IP_Scanner_2.5.4594.1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "advipscan" /tr "C:\Users\Admin\AppData\Local\advanced_ip_scanner\client32.exe" /RL HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:4532
- C:\Users\Admin\AppData\Local\advanced_ip_scanner\client32.exe
  C:\Users\Admin\AppData\Local\advanced_ip_scanner\client32.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:468
- C:\ProgramData\Advanced_Port_Scanner_2.5.3869.exe
  C:\ProgramData\Advanced_Port_Scanner_2.5.3869.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Users\Admin\AppData\Local\Temp\is-IM7QC.tmp\Advanced_Port_Scanner_2.5.3869.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-IM7QC.tmp\Advanced_Port_Scanner_2.5.3869.tmp" /SL5="$80118,19769177,139776,C:\ProgramData\Advanced_Port_Scanner_2.5.3869.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Advanced_Port_Scanner_2.5.3869.exe

Filesize
19.4MB

MD5
6a58b52b184715583cda792b56a0a1ed

SHA1
3477a173e2c1005a81d042802ab0f22cc12a4d55

SHA256
d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb

SHA512
49ee746a98bce076cd20a36d57d08ed0dc39d48a0a2866173d4c0dbb1633e2ec8e069f4dbba578e707c8dd1de1fcc908cf412e4a9fff9ecc78ac92357e75c313

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EHN0R.tmp\aps_is_install_dll.dll

Filesize
381KB

MD5
87e1abf879c7884ae2ad95e674ad6baf

SHA1
63b8d9c89d1b56ccd33c5452c75f344f2dbacdba

SHA256
f983edded650d3ad6a84ed5190f492f689135d9f090dff83f5442310ed67640f

SHA512
08d4b292f250c44d02bfaca569ca3b50fe74ae46d2b88830dce31e910911c2311a8f7658c920343b8ae357abe7b9cb42e8c8b8cba3e8d994728ec01db03e062c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IM7QC.tmp\Advanced_Port_Scanner_2.5.3869.tmp

Filesize
1.1MB

MD5
52a6310c4d59c7c7068ce0cdb076d4ef

SHA1
056698e4c5b6a60a7ef06fcb5b28c9678235aad4

SHA256
37e12903cc165abc6e0629195e0eb5a6318c92614952e055cf3444ad35ed4f0f

SHA512
6b9a83066db30e689109f0f050cbda424039ec4d6076dbd3b198ee348279df9fa0724998cea1f3041fb2f539b0f13dec8c2c087e88655f33fb22d6ca4003f63b

Download Submit
C:\Users\Admin\AppData\Local\advanced_ip_scanner\HTCTL32.DLL

Filesize
306KB

MD5
3eed18b47412d3f91a394ae880b56ed2

SHA1
1b521a3ed4a577a33cce78eee627ae02445694ab

SHA256
13a17f2ad9288aac8941d895251604beb9524fa3c65c781197841ee15480a13f

SHA512
835f35af4fd241caa8b6a639626b8762db8525ccceb43afe8fffc24dffad76ca10852a5a8e9fc114bfbf7d1dc1950130a67037fc09b63a74374517a1f5448990

Download Submit
C:\Users\Admin\AppData\Local\advanced_ip_scanner\MSVCR100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Local\advanced_ip_scanner\NSM.LIC

Filesize
262B

MD5
b9956282a0fed076ed083892e498ac69

SHA1
d14a665438385203283030a189ff6c5e7c4bf518

SHA256
fcc6afd664a8045bd61c398be3c37a97536a199a48d277e11977f93868ae1acc

SHA512
7daa09113c0e8a36c91cc6d657c65851a20dff6b60ac3d2f40c5737c12c1613c553955f84d131ba2139959973fef9fc616ca5e968cb16c25acf2d4739eed87eb

Download Submit
C:\Users\Admin\AppData\Local\advanced_ip_scanner\PCICHEK.DLL

Filesize
27KB

MD5
e311935a26ee920d5b7176cfa469253c

SHA1
eda6c815a02c4c91c9aacd819dc06e32ececf8f0

SHA256
0038ab626624fa2df9f65dd5e310b1206a9cd4d8ab7e65fb091cc25f13ebd34e

SHA512
48164e8841cfc91f4cbf4d3291d4f359518d081d9079a7995378f970e4085b534f4bafc15b83f4824cc79b5a1e54457b879963589b1acbcfe727a03eb3dffd1c

Download Submit
C:\Users\Admin\AppData\Local\advanced_ip_scanner\PCICL32.DLL

Filesize
3.5MB

MD5
0806dd2faf75ef07931f0a0148dabe8a

SHA1
d578f3590af19108a45f1053e7752c72e4e71757

SHA256
1bf1d7e36a7fcae7d5df7a5b926ffd5fe07ecc3b3412d7818a9139f501083c51

SHA512
8c4628da32f25b10f432c7b5af03bd76368f44d8c9c017502e79c1a53548635a4c12c489bdd775bbea888dbab3a51859403e64ca79e39b0938260f1819936ef7

Download Submit
C:\Users\Admin\AppData\Local\advanced_ip_scanner\client32.exe

Filesize
54KB

MD5
9497aece91e1ccc495ca26ae284600b9

SHA1
a005d8ce0c1ea8901c1b4ea86c40f4925bd2c6da

SHA256
1b63f83f06dbd9125a6983a36e0dbd64026bb4f535e97c5df67c1563d91eff89

SHA512
4c892e5029a707bcf73b85ac110d8078cb273632b68637e9b296a7474ab0202320ff24cf6206de04af08abf087654b0d80cbecfae824c06616c47ce93f0929c9

Download Submit
C:\Users\Admin\AppData\Local\advanced_ip_scanner\client32.ini

Filesize
650B

MD5
58f6de6b53d8118b02987f869d8e2543

SHA1
be116ccc31cfa3e62cd9b30b9542dd5fbde26ecb

SHA256
6c73a60110764eef51ca3ee1df1e03d6e53b9f9513805c3948e947a7f49690d8

SHA512
2cb225ea149514ddf61230abe305f00bd503ce4f8a04a1761469379bfca09e20efda9567c53d1240e31c7df492561dbaad942f07f40aa92ce3bdf4ebf4de59d7

Download Submit
C:\Users\Admin\AppData\Local\advanced_ip_scanner\pcicapi.dll

Filesize
44KB

MD5
9daa86d91a18131d5caf49d14fb8b6f2

SHA1
6b2f7ceb6157909e114a2b05a48a1a2606b5caf1

SHA256
1716640cce74322f7ee3e3e02b75cd53b91686f66e389d606dab01bd9f88c557

SHA512
9a98e0d9e2dda8aefa54bddb3c7b71501d638dff68863939de6caa117b0e7bf15e581a75419ef8a0da3f1c56a19f1b0f4c86d65f8581773ab88ff5764b9bb3aa

Download Submit
memory/1864-66-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1864-80-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2184-0-0x0000000000760000-0x0000000000788000-memory.dmp

Filesize
160KB

Download
memory/2184-64-0x0000000000760000-0x0000000000788000-memory.dmp

Filesize
160KB

Download
memory/2680-81-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download