netsupport | 8a48f0621fd8ba7762c1630a05d9a1ba852b9e3f2ad9132196902efb3119e347 | Triage

Sharing

General

Target

84f2d273623efb6cdd126a89c1f9567e8977d21ffe684758dd722a27d2d53aa9.zip
Size

9.8MB
Sample

241029-p4e5ysvhqn
MD5

7dd5e3cc74d4f813a81c0b03dd4c61ca
SHA1

b5889082d19074d74e4cd6017fd46f1a83cd765c
SHA256

8a48f0621fd8ba7762c1630a05d9a1ba852b9e3f2ad9132196902efb3119e347
SHA512

eef55a0a72f0c9e551e8ee7937c43e9d2fb4094f0a87a1413388e31c5e6671459c61b55c019a4d664171b67d8dc460e21f6095ecdd05a6e6e75550dfbba0531b
SSDEEP

196608:LoRPpiCZMbxmkmv7YPDLlxwnvHBd0XB1Ksali70v34nfXpODG32Liyjt4L:Lo9ZQmkDPDL0nvHBdKwski7KInkG3Ny4

Score

10^/10

netsupport discovery execution persistence privilege_escalation rat

Malware Config

Targets

- Target
  
  84f2d273623efb6cdd126a89c1f9567e8977d21ffe684758dd722a27d2d53aa9.zip
- Size
  
  9.9MB
- MD5
  
  dfaace3296fabb7f9652fb36756a4b51
- SHA1
  
  65e87e3efdc905c49198ddb97110f54d0a306a8f
- SHA256
  
  84f2d273623efb6cdd126a89c1f9567e8977d21ffe684758dd722a27d2d53aa9
- SHA512
  
  3edd42734a8141e9d7fe27d9cc87f84411cf501b496f4cd83217355e636604936df2c7114463366ce8a316421d0ba43d19d080344b7c5c51d640ab76c1a6050b
- SSDEEP
  
  196608:CLFqy0ANIjC3Lh9KvhE/tjTMLoWMsJQwfwr2NV9lDegE5PTtvNBZXcnCncN:CL/TjLuvhCjTIJhfwr2NnVrWlIH
Score

10^/10

netsupport discovery execution persistence privilege_escalation rat
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Netsupport family
  netsupport
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Event Triggered Execution

Component Object Model Hijacking

Privilege Escalation

Event Triggered Execution

Component Object Model Hijacking

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

netsupportdiscoveryexecutionpersistenceprivilege_escalationrat