netsupport | 5b2c19c32d0a4725f4d5057bab96ebc00a60774926c04daa451f628677762603

Resubmissions

30-07-2024 14:18

240730-rml82stbkq 10

30-07-2024 01:45

240730-b6d4sawcld 3

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
30-07-2024 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

srgjsrtyjstryjkwssdty.ps1
Size

789B
MD5

175251f9d896e7faf156eb7c6865ddae
SHA1

0665df5296b40ed0fcddefedeb82c96dada5cdac
SHA256

a288c22b7c277f9fb41a46793ab5651f93e0a99f03332ac7b0f36a169ca7d321
SHA512

90fa93dfd7f8751e0164dd305b11388941b36f599cd39f19744de2069cd0ca5df1984649fdaf97cd8949bbe0eff7a692703d2fdd174202e5fb2652618b2fead6

Score

10^/10

netsupport discovery execution rat

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Executes dropped EXE 1 IoCs

pid	Process
2904	soft.exe

Loads dropped DLL 5 IoCs

pid	Process
2904	soft.exe
2904	soft.exe
2904	soft.exe
2904	soft.exe
2904	soft.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1960	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	soft.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 3 IoCs

pid	Process
2020	66.exe
1816	66.exe
2772	66.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeRestorePrivilege	2020	66.exe
Token: 35	2020	66.exe
Token: SeSecurityPrivilege	2020	66.exe
Token: SeSecurityPrivilege	2020	66.exe
Token: SeRestorePrivilege	1816	66.exe
Token: 35	1816	66.exe
Token: SeSecurityPrivilege	1816	66.exe
Token: SeSecurityPrivilege	1816	66.exe
Token: SeRestorePrivilege	2772	66.exe
Token: 35	2772	66.exe
Token: SeSecurityPrivilege	2772	66.exe
Token: SeSecurityPrivilege	2772	66.exe
Token: SeSecurityPrivilege	2904	soft.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2904	soft.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1956	1960	powershell.exe	32
PID 1960 wrote to memory of 1956	1960	powershell.exe	32
PID 1960 wrote to memory of 1956	1960	powershell.exe	32
PID 1956 wrote to memory of 2020	1956	cmd.exe	33
PID 1956 wrote to memory of 2020	1956	cmd.exe	33
PID 1956 wrote to memory of 2020	1956	cmd.exe	33
PID 1956 wrote to memory of 2020	1956	cmd.exe	33
PID 1960 wrote to memory of 2668	1960	powershell.exe	34
PID 1960 wrote to memory of 2668	1960	powershell.exe	34
PID 1960 wrote to memory of 2668	1960	powershell.exe	34
PID 2668 wrote to memory of 1816	2668	cmd.exe	35
PID 2668 wrote to memory of 1816	2668	cmd.exe	35
PID 2668 wrote to memory of 1816	2668	cmd.exe	35
PID 2668 wrote to memory of 1816	2668	cmd.exe	35
PID 1960 wrote to memory of 2700	1960	powershell.exe	36
PID 1960 wrote to memory of 2700	1960	powershell.exe	36
PID 1960 wrote to memory of 2700	1960	powershell.exe	36
PID 2700 wrote to memory of 2772	2700	cmd.exe	37
PID 2700 wrote to memory of 2772	2700	cmd.exe	37
PID 2700 wrote to memory of 2772	2700	cmd.exe	37
PID 2700 wrote to memory of 2772	2700	cmd.exe	37
PID 1960 wrote to memory of 2904	1960	powershell.exe	38
PID 1960 wrote to memory of 2904	1960	powershell.exe	38
PID 1960 wrote to memory of 2904	1960	powershell.exe	38
PID 1960 wrote to memory of 2904	1960	powershell.exe	38

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\srgjsrtyjstryjkwssdty.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "VFS\ProgramFilesX64\66\66.exe e VFS\ProgramFilesX64\programm3.7z -oC:\Users\Public\Pictures\programm -pprogramm3"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Users\Admin\AppData\Local\Temp\VFS\ProgramFilesX64\66\66.exe
    VFS\ProgramFilesX64\66\66.exe e VFS\ProgramFilesX64\programm3.7z -oC:\Users\Public\Pictures\programm -pprogramm3
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "VFS\ProgramFilesX64\66\66.exe e C:\Users\Public\Pictures\programm\programm2.7z -oC:\Users\Public\Pictures\programm -pprogramm2"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Users\Admin\AppData\Local\Temp\VFS\ProgramFilesX64\66\66.exe
    VFS\ProgramFilesX64\66\66.exe e C:\Users\Public\Pictures\programm\programm2.7z -oC:\Users\Public\Pictures\programm -pprogramm2
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "VFS\ProgramFilesX64\66\66.exe e C:\Users\Public\Pictures\programm\programm1.7z -oC:\Users\Public\Pictures\programm -pprogramm1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Users\Admin\AppData\Local\Temp\VFS\ProgramFilesX64\66\66.exe
    VFS\ProgramFilesX64\66\66.exe e C:\Users\Public\Pictures\programm\programm1.7z -oC:\Users\Public\Pictures\programm -pprogramm1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2772
- C:\Users\Public\Pictures\programm\soft.exe
  "C:\Users\Public\Pictures\programm\soft.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Pictures\programm\MSVCR100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Public\Pictures\programm\NSM.LIC

Filesize
2KB

MD5
52696f6345ef7afbfa28380f140bc770

SHA1
102839cbfa6970c0ba5c1e12fe036cc4322620a2

SHA256
fdba04fb98dab25b2e60d5a0a95996f2cad7bff0d1803d884400a3d13acabcf1

SHA512
8143d6a021a6fbf1814fc1f9a110ca124c24cf2a72c320370dc3c18f50c1618999dcbd0dba0efa1ed12339531d30b5cfa0d5a5b2a019824d7dc0772aae5e5e2f

Download Submit
C:\Users\Public\Pictures\programm\PCICL32.dll

Filesize
3.5MB

MD5
ad51946b1659ed61b76ff4e599e36683

SHA1
dfe2439424886e8acf9fa3ffde6caaf7bfdd583e

SHA256
07a191254362664b3993479a277199f7ea5ee723b6c25803914eedb50250acf4

SHA512
6c30e7793f69508f6d9aa6edcec6930ba361628ef597e32c218e15d80586f5a86d89fcbee63a35eab7b1e0ae26277512f4c1a03df7912f9b7ff9a9a858cf3962

Download Submit
C:\Users\Public\Pictures\programm\client32.ini

Filesize
641B

MD5
3c3efb32e77a115e45d570a83f1ddb8d

SHA1
b513339ff89f02ddd1f26101b880506238eb680e

SHA256
6cf0dff63f4e65bdf05677d3156692acaf2a8c4e7ec96cfe290e9a8c461a48b2

SHA512
28a26c92c20c2b812fe0ca61ab18e4361a0204792290205efe3215746e3904cf9c67016c211ca9ace02741fb9fbe6b22b9d6560d08dd84dc63e4281ecf170b12

Download Submit
C:\Users\Public\Pictures\programm\pcicapi.dll

Filesize
32KB

MD5
dcde2248d19c778a41aa165866dd52d0

SHA1
7ec84be84fe23f0b0093b647538737e1f19ebb03

SHA256
9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

SHA512
c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

Download Submit
C:\Users\Public\Pictures\programm\pcichek.dll

Filesize
18KB

MD5
a0b9388c5f18e27266a31f8c5765b263

SHA1
906f7e94f841d464d4da144f7c858fa2160e36db

SHA256
313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

SHA512
6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

Download Submit
C:\Users\Public\Pictures\programm\programm1.7z

Filesize
1.4MB

MD5
b8182677ab16dce667e20d33a6176c1d

SHA1
40a506c1cec627a781f0ec49973e691a8f68e326

SHA256
51e5c3c3afa0744970e772bf0c53768d9d9856801e7cd682b1edbf52f7e689fa

SHA512
d86cafc98fac2dd5b1af1202adae3d35419439e9984f6027119a828d46f47e0d45fc6889b0182b2b2bf599d59e614f6d86b0348e20a4655c5be5b3c9d47e2457

Download Submit
C:\Users\Public\Pictures\programm\programm2.7z

Filesize
1.4MB

MD5
0521bd9a3fb18805722e4473c09a7c43

SHA1
25ac677556421ecf2209b1d6ba70f9af20cdc7a7

SHA256
16f8bad5154d5c557794a43ba2acc260e70d142df25fc424eaea8378d4e70dc9

SHA512
507ce217b49fc53c535714e854378aed1531efe5697948fd982ffbc43a326e9a13d72c9557b5437b6e7d2ef620572cfc19ca9fc4807dd692877522ddce047fca

Download Submit
C:\Users\Public\Pictures\programm\soft.exe

Filesize
54KB

MD5
4cb25a4d34304410017210125112bc79

SHA1
021f72c016402db9fef4e1953f1b4b7251fea2fb

SHA256
3d15fff559a6279db51ae58202c03167f69797340c4e581a6b5c4898d8e2e244

SHA512
62f32e442f587950223f816fbde09d4eaaea38c5365209894a7df6e3b296153ee480289666904b0feb9996277af750b539f0b8564bbe66e7e822bddc828d6e74

Download Submit
\Users\Public\Pictures\programm\HTCTL32.DLL

Filesize
320KB

MD5
2d3b207c8a48148296156e5725426c7f

SHA1
ad464eb7cf5c19c8a443ab5b590440b32dbc618f

SHA256
edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

SHA512
55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

Download Submit
memory/1960-10-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/1960-11-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/1960-16-0x000000001BD20000-0x000000001BDF6000-memory.dmp

Filesize
856KB

Download
memory/1960-17-0x000000001C7F0000-0x000000001C876000-memory.dmp

Filesize
536KB

Download
memory/1960-14-0x000000001BBF0000-0x000000001BBFE000-memory.dmp

Filesize
56KB

Download
memory/1960-13-0x000000001BBD0000-0x000000001BBEC000-memory.dmp

Filesize
112KB

Download
memory/1960-12-0x000000001BBC0000-0x000000001BBCC000-memory.dmp

Filesize
48KB

Download
memory/1960-15-0x000000001BC00000-0x000000001BC5A000-memory.dmp

Filesize
360KB

Download
memory/1960-4-0x000007FEF5BEE000-0x000007FEF5BEF000-memory.dmp

Filesize
4KB

Download
memory/1960-6-0x00000000021E0000-0x00000000021E8000-memory.dmp

Filesize
32KB

Download
memory/1960-9-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/1960-8-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/1960-7-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/1960-5-0x000000001B4B0000-0x000000001B792000-memory.dmp

Filesize
2.9MB

Download
memory/1960-64-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download