Analysis
- max time kernel
149s - max time network
141s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 08:24
General
- Target 52425be01415a7c24b6b682230a62ad769dce317efb6959aa06f33e985f6daec.ps1
- Size 4.7MB
- Sample260511-ka695agy6k
- SHA256 52425be01415a7c24b6b682230a62ad769dce317efb6959aa06f33e985f6daec
Malware Config
Signatures
- Family: NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- Badlisted process makes network request 16 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 5 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\52425be01415a7c24b6b682230a62ad769dce317efb6959aa06f33e985f6daec.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Portmaster\Rapid\SBmodule_v2_0\123e362fc57e1e68\nexus.exe"C:\Users\Admin\AppData\Roaming\Portmaster\Rapid\SBmodule_v2_0\123e362fc57e1e68\nexus.exe" "C:\Users\Admin\AppData\Roaming\Portmaster\Rapid\SBmodule_v2_0\123e362fc57e1e68\"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_2l0s4mdo.40m.ps1
HTCTL32.DLL
NSM.LIC
PCICAPI.dll
PCICHEK.DLL
PCICL32.DLL
client32.ini
msvcr100.dll
nexus.exe
memory/1612-91-0x0000000000AD0000-0x0000000000B4A000-memory.dmp
memory/5496-11-0x000002D421D60000-0x000002D421D70000-memory.dmp
memory/5496-87-0x000002D421CB0000-0x000002D421CBC000-memory.dmp
memory/5496-27-0x00007FF883960000-0x00007FF884422000-memory.dmp
memory/5496-29-0x00007FF88411F000-0x00007FF884373000-memory.dmp
memory/5496-32-0x00007FF883960000-0x00007FF884422000-memory.dmp
memory/5496-33-0x000002D421B50000-0x000002D421B5A000-memory.dmp
memory/5496-34-0x000002D44A340000-0x000002D44A352000-memory.dmp
memory/5496-46-0x00007FF883960000-0x00007FF884422000-memory.dmp
memory/5496-0-0x000002D421D60000-0x000002D421D70000-memory.dmp
memory/5496-13-0x000002D421DE0000-0x000002D421DF2000-memory.dmp
memory/5496-14-0x000002D421D60000-0x000002D421D70000-memory.dmp
memory/5496-12-0x000002D421CB0000-0x000002D421CBC000-memory.dmp
memory/5496-23-0x00007FF883960000-0x00007FF884422000-memory.dmp
memory/5496-73-0x000002D44A360000-0x000002D44A37C000-memory.dmp
memory/5496-74-0x000002D44AC60000-0x000002D44AD13000-memory.dmp
memory/5496-77-0x000002D421B70000-0x000002D421B7A000-memory.dmp
memory/5496-8-0x000002D43A2D0000-0x000002D43A2F2000-memory.dmp
memory/5496-1-0x000002D421D60000-0x000002D421D70000-memory.dmp
memory/5496-9-0x000002D421D60000-0x000002D421D70000-memory.dmp
memory/5496-80-0x000002D44AD20000-0x000002D44AD3C000-memory.dmp
memory/5496-81-0x00007FF883960000-0x00007FF884422000-memory.dmp
memory/5496-84-0x000002D44A380000-0x000002D44A3D6000-memory.dmp
memory/5496-10-0x000002D421D60000-0x000002D421D70000-memory.dmp
memory/5496-89-0x000002D44A380000-0x000002D44A3D6000-memory.dmp
memory/5496-90-0x00007FF883960000-0x00007FF884422000-memory.dmp
memory/5496-24-0x00007FF88411F000-0x00007FF884373000-memory.dmp