netsupport | 5b2c19c32d0a4725f4d5057bab96ebc00a60774926c04daa451f628677762603

Resubmissions

30-07-2024 14:18

240730-rml82stbkq 10

30-07-2024 01:45

240730-b6d4sawcld 3

Analysis

max time kernel
0s
max time network
16s
platform
windows11-21h2_x64
resource
win11-20240729-en
resource tags

arch:x64arch:x86image:win11-20240729-enlocale:en-usos:windows11-21h2-x64system
submitted
30-07-2024 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

srgjsrtyjstryjkwssdty.ps1
Size

789B
MD5

175251f9d896e7faf156eb7c6865ddae
SHA1

0665df5296b40ed0fcddefedeb82c96dada5cdac
SHA256

a288c22b7c277f9fb41a46793ab5651f93e0a99f03332ac7b0f36a169ca7d321
SHA512

90fa93dfd7f8751e0164dd305b11388941b36f599cd39f19744de2069cd0ca5df1984649fdaf97cd8949bbe0eff7a692703d2fdd174202e5fb2652618b2fead6

Score

10^/10

netsupport execution rat

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4464	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4464	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\srgjsrtyjstryjkwssdty.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "VFS\ProgramFilesX64\66\66.exe e VFS\ProgramFilesX64\programm3.7z -oC:\Users\Public\Pictures\programm -pprogramm3"
  2⤵
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\VFS\ProgramFilesX64\66\66.exe
    VFS\ProgramFilesX64\66\66.exe e VFS\ProgramFilesX64\programm3.7z -oC:\Users\Public\Pictures\programm -pprogramm3
    3⤵
    PID:3176
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "VFS\ProgramFilesX64\66\66.exe e C:\Users\Public\Pictures\programm\programm2.7z -oC:\Users\Public\Pictures\programm -pprogramm2"
  2⤵
  PID:3484
- - C:\Users\Admin\AppData\Local\Temp\VFS\ProgramFilesX64\66\66.exe
    VFS\ProgramFilesX64\66\66.exe e C:\Users\Public\Pictures\programm\programm2.7z -oC:\Users\Public\Pictures\programm -pprogramm2
    3⤵
    PID:1608
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "VFS\ProgramFilesX64\66\66.exe e C:\Users\Public\Pictures\programm\programm1.7z -oC:\Users\Public\Pictures\programm -pprogramm1"
  2⤵
  PID:2976
- - C:\Users\Admin\AppData\Local\Temp\VFS\ProgramFilesX64\66\66.exe
    VFS\ProgramFilesX64\66\66.exe e C:\Users\Public\Pictures\programm\programm1.7z -oC:\Users\Public\Pictures\programm -pprogramm1
    3⤵
    PID:4488
- C:\Users\Public\Pictures\programm\soft.exe
  "C:\Users\Public\Pictures\programm\soft.exe"
  2⤵
  PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_utgliqks.43q.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Public\Pictures\programm\HTCTL32.DLL

Filesize
320KB

MD5
2d3b207c8a48148296156e5725426c7f

SHA1
ad464eb7cf5c19c8a443ab5b590440b32dbc618f

SHA256
edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

SHA512
55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

Download Submit
C:\Users\Public\Pictures\programm\NSM.LIC

Filesize
2KB

MD5
52696f6345ef7afbfa28380f140bc770

SHA1
102839cbfa6970c0ba5c1e12fe036cc4322620a2

SHA256
fdba04fb98dab25b2e60d5a0a95996f2cad7bff0d1803d884400a3d13acabcf1

SHA512
8143d6a021a6fbf1814fc1f9a110ca124c24cf2a72c320370dc3c18f50c1618999dcbd0dba0efa1ed12339531d30b5cfa0d5a5b2a019824d7dc0772aae5e5e2f

Download Submit
C:\Users\Public\Pictures\programm\PCICHEK.DLL

Filesize
18KB

MD5
a0b9388c5f18e27266a31f8c5765b263

SHA1
906f7e94f841d464d4da144f7c858fa2160e36db

SHA256
313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

SHA512
6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

Download Submit
C:\Users\Public\Pictures\programm\PCICL32.DLL

Filesize
1.2MB

MD5
19f05c9295f0e2047a1bee9e4ffde1ef

SHA1
8246f92d8eb1743876ff4b946ef228fba290f6d9

SHA256
d56bed7ffac8e5f83bcb95763aa0637b8ef0ec301bc89d45165dfaae1ad1504a

SHA512
285aa23d5ecba0d4a7668530f54b0de2355e069319f94390f6b4c565b259d8c2e6fe5b8b92b94e4483050c2064454629f47c34deeb85bb07590500bb9676324a

Download Submit
C:\Users\Public\Pictures\programm\PCICL32.dll

Filesize
1.3MB

MD5
b288e7f14568d97fa6d889dbf4a29600

SHA1
99b8ed671f1babb0b6573d7bd456ba4f112ceafb

SHA256
090fdf7ef3b59ac3a393b7ba45062d75236ffc32187a26d9ff682dd18d97c083

SHA512
5a3c2dec2b0d842bcd97eb2640e4ec877335f6abc0b55ed06765007a46801058366097c918bfff2c3b6e6972f7a849bd6c141e958a6ecd6ab1d7e86e3f47d410

Download Submit
C:\Users\Public\Pictures\programm\client32.ini

Filesize
641B

MD5
3c3efb32e77a115e45d570a83f1ddb8d

SHA1
b513339ff89f02ddd1f26101b880506238eb680e

SHA256
6cf0dff63f4e65bdf05677d3156692acaf2a8c4e7ec96cfe290e9a8c461a48b2

SHA512
28a26c92c20c2b812fe0ca61ab18e4361a0204792290205efe3215746e3904cf9c67016c211ca9ace02741fb9fbe6b22b9d6560d08dd84dc63e4281ecf170b12

Download Submit
C:\Users\Public\Pictures\programm\msvcr100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Public\Pictures\programm\pcicapi.dll

Filesize
32KB

MD5
dcde2248d19c778a41aa165866dd52d0

SHA1
7ec84be84fe23f0b0093b647538737e1f19ebb03

SHA256
9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

SHA512
c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

Download Submit
C:\Users\Public\Pictures\programm\programm1.7z

Filesize
1.1MB

MD5
cb3156233eb856da948892e234d63df4

SHA1
5928149e8398e2de192c2c862bbfab56997ee3c3

SHA256
563073487be328c6cc77548e237e4be8a921b03eaa07040f50d034d32bfda52b

SHA512
f6323069c5bb30d5a7a0d6f343e51fbbc87ec9a18a234ecccdfc47809a8aeb14b6c1f9723c67f63de32dd480cbd0efcedb1cf25021db806e92a8075ca9107cd4

Download Submit
C:\Users\Public\Pictures\programm\programm2.7z

Filesize
1.3MB

MD5
8aca526df5847f36616c01cf839847f1

SHA1
6f186ea481ec6a6ccb45520f009147e44a5babe3

SHA256
9d501d839abfdb52678036042309a881357bd04f6c7d647d54a66dd7ca9f4062

SHA512
8d69e6c6cfea5b742788664df4cbaafb35dc63b407b892c319049fc475f4b2afa6316c7f199e0f39ee8801bb6fb91bebde78b5e564563a1c49a103ca828084ae

Download Submit
C:\Users\Public\Pictures\programm\soft.exe

Filesize
54KB

MD5
4cb25a4d34304410017210125112bc79

SHA1
021f72c016402db9fef4e1953f1b4b7251fea2fb

SHA256
3d15fff559a6279db51ae58202c03167f69797340c4e581a6b5c4898d8e2e244

SHA512
62f32e442f587950223f816fbde09d4eaaea38c5365209894a7df6e3b296153ee480289666904b0feb9996277af750b539f0b8564bbe66e7e822bddc828d6e74

Download Submit
memory/4464-57-0x00007FFFC7BC0000-0x00007FFFC8682000-memory.dmp

Filesize
10.8MB

Download
memory/4464-0-0x00007FFFC7BC3000-0x00007FFFC7BC5000-memory.dmp

Filesize
8KB

Download
memory/4464-12-0x00007FFFC7BC0000-0x00007FFFC8682000-memory.dmp

Filesize
10.8MB

Download
memory/4464-11-0x00007FFFC7BC0000-0x00007FFFC8682000-memory.dmp

Filesize
10.8MB

Download
memory/4464-10-0x00007FFFC7BC0000-0x00007FFFC8682000-memory.dmp

Filesize
10.8MB

Download
memory/4464-9-0x00000232D9CB0000-0x00000232D9CD2000-memory.dmp

Filesize
136KB

Download