netsupport | bd97ecf1a07fbc5cc1cfcbdfb73368e01f14c3e8abe061f73543627bddd9eb6d

Analysis

max time kernel
135s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
08/07/2025, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sublime_textx64.exe
Size 20.5MB
Sample250708-m77chawvbw
SHA256 bd97ecf1a07fbc5cc1cfcbdfb73368e01f14c3e8abe061f73543627bddd9eb6d
MD5 46720657043a17fe55e1c1637718308b
SHA1 bd1ddd7bbde4338d71b7db508d232fc890f31ca1
SHA512 d16871cdc9562b7199c737a8e2bcba3b23c441108ed8509c959da2d5435c92ebde0e83a2b896887d60095dd28dbaa5161a710bc234b7e315f9b3bbdcc57ce35e
SSDEEP 393216:2Zag92Nb3lLJAqF5NjyTOo3dIOTqm5XR8qNv+a9YrJDyjXb+:26xJAqPNeTOo3TnR3B9QJDO+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

netsupport discovery persistence rat

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport
Netsupport family
netsupport

Executes dropped EXE 2 IoCs

pid	Process
3604	client32.exe
2512	client32.exe

Loads dropped DLL 12 IoCs

pid	Process
1692	sublime_textx64.exe
3604	client32.exe
3604	client32.exe
3604	client32.exe
3604	client32.exe
3604	client32.exe
2512	client32.exe
2512	client32.exe
2512	client32.exe
2512	client32.exe
2512	client32.exe
3604	client32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Windows\CurrentVersion\Run\SublmClient32 = "C:\\Users\\Admin\\AppData\\Local\\Sblm718\\client32.exe"	sublime_textx64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sublime_textx64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3604	client32.exe
Token: SeSecurityPrivilege	2512	client32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2512	client32.exe
3604	client32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 3604	1692	sublime_textx64.exe	83
PID 1692 wrote to memory of 3604	1692	sublime_textx64.exe	83
PID 1692 wrote to memory of 3604	1692	sublime_textx64.exe	83
PID 5904 wrote to memory of 2512	5904	cmd.exe	85
PID 5904 wrote to memory of 2512	5904	cmd.exe	85
PID 5904 wrote to memory of 2512	5904	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\sublime_textx64.exe
"C:\Users\Admin\AppData\Local\Temp\sublime_textx64.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Users\Admin\AppData\Local\Sblm718\client32.exe
  C:\Users\Admin\AppData\Local\Sblm718\client32.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Sblm718\client32.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Users\Admin\AppData\Local\Sblm718\client32.exe
  C:\Users\Admin\AppData\Local\Sblm718\client32.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HTCTL32.DLL

Path C:\Users\Admin\AppData\Local\Sblm718\HTCTL32.DLL
Size 320KB
SHA256 edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796
MD5 2d3b207c8a48148296156e5725426c7f
SHA1 ad464eb7cf5c19c8a443ab5b590440b32dbc618f
SHA512 55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c
SSDEEP 6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
MD5 SHA1 SHA512 SSDEEP

Submit Download

NSM.LIC

Path C:\Users\Admin\AppData\Local\Sblm718\NSM.LIC
Size 253B
SHA256 9c48ab2790281fca8d75abc805e6091f1b8133898852e6c09657d66f3dd0c48f
MD5 12b8cc1d0a34012bbbbe86880333c567
SHA1 e89659c412af82e31e6d14c34e47d7cc4c5ec9a5
SHA512 eb44405dc70b40f15463c075f57b535b6e7c5132a34a99a62d663566ddc50b82f329c40880ab4a5425fe41077d5eec2c28baa500d3b27182ac5f104038ca00dc
MD5 SHA1 SHA512

Submit Download

PCICHEK.DLL

Path C:\Users\Admin\AppData\Local\Sblm718\PCICHEK.DLL
Size 18KB
SHA256 313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
MD5 a0b9388c5f18e27266a31f8c5765b263
SHA1 906f7e94f841d464d4da144f7c858fa2160e36db
SHA512 6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd
SSDEEP 192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
MD5 SHA1 SHA512 SSDEEP

Submit Download

PCICL32.dll

Path C:\Users\Admin\AppData\Local\Sblm718\PCICL32.dll
Size 3.5MB
SHA256 80cc439a0633add1dd964bb6bb40ccdcfec3ae28da39fd9416642ab0605d40ab
MD5 d16ffa06a35601a73b73836bf905ed19
SHA1 b8231d36f921e5b75b592ea3374f19216a5c411f
SHA512 e79b8cfbdd4d86742420a334ab6e0d70bcd3393ab8b07ae6d49ec435aef2bcbd07681774ac7e66eca41c11aa086b398440f74f0b1b77087aa2c18b76c6f3a168
SSDEEP 49152:XQ8QqFfxm8YV0J05xlibLK2MTc/aBcOSENPsP:XQ8LFfxg5xkL18Se6
MD5 SHA1 SHA512 SSDEEP

Submit Download

client32.exe

Path C:\Users\Admin\AppData\Local\Sblm718\client32.exe
Size 33KB
SHA256 973836529b57815903444dd5d4b764e8730986b1bd87179552f249062ee26128
MD5 290c26b1579fd3e48d60181a2d22a287
SHA1 e4c91a7f161783c68cf67250206047f23bd25a29
SHA512 114a9f068b36a1edf5cce9269057f0cc17b22a10cd73cbed3ef42ae71324e41363e543a3af8be57b410c533b62bcf7f28650b464cce96e0e6c14819cdb90129a
SSDEEP 192:7SVVGg84ZVe9LQTsZ98A2QakMnCaJN8TvyowJL/8Qpkqs1I1jw+ebCfaFLrWn:7yIwamdkjy8bYJLu1SmbCShrWn
MD5 SHA1 SHA512 SSDEEP

Submit Download

client32.ini

Path C:\Users\Admin\AppData\Local\Sblm718\client32.ini
Size 1015B
SHA256 c1022d6b436c0586521cf1af941d77bf19f2f0220bc8b204cffce314cf5a2983
MD5 17c5e53b00782ded1b35e7caae4db226
SHA1 29af19a135e49e315e0983c7298e2db379655492
SHA512 64cfd6ffc1b261322911b95f9c2d27351dccf93cdbcd581349808521d83d320d8fa0f9f7bc71d6ca3f2ac0c761399661d27806318e9cb6805efe32c141486b6b
MD5 SHA1 SHA512

Submit Download

msvcr100.dll

Path C:\Users\Admin\AppData\Local\Sblm718\msvcr100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

pcicapi.dll

Path C:\Users\Admin\AppData\Local\Sblm718\pcicapi.dll
Size 32KB
SHA256 9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917
MD5 dcde2248d19c778a41aa165866dd52d0
SHA1 7ec84be84fe23f0b0093b647538737e1f19ebb03
SHA512 c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166
SSDEEP 768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sublime_text.exe

Path C:\Users\Admin\AppData\Local\Sublime Text\718\sublime_text.exe
Size 7.4MB
SHA256 67d363dc7a54808624c1d0e4837ee5258974d338d1117738046a5a823ab4c16a
MD5 671b865fbde25cdcbd0144d3e7baea31
SHA1 eaa799e81240f275c44617804f511d369334c241
SHA512 84078f0d93649b59f7915e183d103a66488b96a7c3465962a4ac7fa5e34a37cb74e24101ccb502b0cfe14e0be6cf2d2f12e8c9ec00e970884a961d768d49f962
SSDEEP 98304:VjVhsPmwAHbVAub2sGzzHnTNXjbjUJvpAVx02+3v6jBNkYVpkZFBEXUS:pjsPmtHGzzRupUx02LrbnkZ3EXd
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz5DF0.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
MD5 SHA1 SHA512 SSDEEP

Submit Download

tempico.ico

Path C:\Users\Admin\AppData\Local\Temp\tempico.ico
Size 4KB
SHA256 1fe1b2d465347bb462a1df2eae0359a1461dd84e709581b5f26f6fb8654c2152
MD5 76685dfa5860561a421b7acc5f5c37fb
SHA1 5fa8562c445fe49cc9359636135201e6a536ec7b
SHA512 214f54e0049d7c46ea4f2ab5117e92468e39cc9e14351eb1d269ba0c7de1f4b819a67ef7624aee78d1c1a8a592a421bea14f7b401206adc41166ade4c31f55cf
SSDEEP 48:c/Rx4H4ONkUvOvg9wMSDQPxQV3Po8w+RV4yMXU3X9q7ONkUvOvg9wMSDQPxQV3P8:7YONfeZEWVArvU3mONfeZEWV4+xF9pU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads