netsupport | 796897808e7d751ac0007e54a1cd2290da046f9dabcb7a3074f23a6039564256

General

Target
file.exe
Size 5.7MB
Sample261004-we9ftstepb
SHA256 796897808e7d751ac0007e54a1cd2290da046f9dabcb7a3074f23a6039564256
MD5 8c3dd656daaafe66e19afd5cb76d8a7d
SHA1 f32f7f526f517a2b06e1a97950fd8f780c0f8d27
SHA512 4262854bfd712d9eed526608c0339336038d01ba166e094ba4c53d7bad3770ad68f3f4aa05f0c735c03ccd38cf1e2b38a94ac18cfb820a6c5803861ada728ccb
SSDEEP 98304:UgipDkai3Dg3DuJPRFyKQuowaoMIjaroR7jH:UxDFCD7FyKxH28aro5H
TLSH
T108564926280475A1C2561C77B517325CE10FD9C5FE8ECBF578A4EEDE4CE2AB51A228C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery netsupport persistence privilege_escalation rat

Malware Config

Signatures

Family: NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk	file.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk	file.exe

Executes dropped EXE 1 IoCs

pid	Process
2420	client32.exe

Loads dropped DLL 5 IoCs

pid	Process
2420	client32.exe
2420	client32.exe
2420	client32.exe
2420	client32.exe
2420	client32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	client32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	client32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2420	client32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	client32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 2420	4620	file.exe	93

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Users\Admin\AppData\Roaming\ZRyf1B31\client32.exe
  "C:\Users\Admin\AppData\Roaming\ZRyf1B31\client32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HTCTL32.DLL

Path C:\Users\Admin\AppData\Roaming\ZRyf1B31\HTCTL32.DLL
Size 320KB
SHA256 3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
MD5 c94005d2dcd2a54e40510344e0bb9435
SHA1 55b4a1620c5d0113811242c20bd9870a1e31d542
SHA512 2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
SSDEEP 6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
TLSH
T117646C21BD80C031F2966075C5BDDBBA0D6DB470376860DBBBD909B96F686D3663830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSM.LIC

Path C:\Users\Admin\AppData\Roaming\ZRyf1B31\NSM.LIC
Size 262B
SHA256 88448fa440aeaff2b4c43f9daca92f9948e32d1e42e822695902a870a23173bc
MD5 35b4ea845eb5d44743a5e68ad8f24c91
SHA1 4109e52c70a3d3749207d7b48d632f044bbc090d
SHA512 b47f8bc0dcb99de187f09cfd79a15f0c3ed59b36df088c0ffb36b6970759511ef93cd868693f727c2a9ac043b3721c127f1b494c45a246c90c1fc038409b96fa
TLSH
T190D02BC59212101783D15151BF9AA8AE92C8B014C2E86854FAF91B662EA54201ACD45C
MD5 SHA1 SHA512 TLSH

Submit Download

PCICHEK.DLL

Path C:\Users\Admin\AppData\Roaming\ZRyf1B31\PCICHEK.DLL
Size 18KB
SHA256 956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
MD5 104b30fef04433a2d2fd1d5f99f179fe
SHA1 ecb08e224a2f2772d1e53675bedc4b2c50485a41
SHA512 5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
SSDEEP 192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
TLSH
T12A8218D21F686143EBE38E70A5EAD7165D36B6D09B7481EF307981452EC0BE03E6871E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCICL32.DLL

Path C:\Users\Admin\AppData\Roaming\ZRyf1B31\PCICL32.DLL
Size 3.6MB
SHA256 38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
MD5 d3d39180e85700f72aaae25e40c125ff
SHA1 f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
SHA512 471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
SSDEEP 49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/
TLSH
T134060832E548CC71D156407AEC7DAADD45162DA00F1981EF3A8DB9692EF23C432F8E5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client32.exe

Path C:\Users\Admin\AppData\Roaming\ZRyf1B31\client32.exe
Size 121KB
SHA256 06b293ab4070517c3d7afdf31134049f1fb7bc50ca10277d7cd2aa7c712ae39f
MD5 a730529e0b2322b12d8c6cbcf038acc5
SHA1 0be926d747a77b741d344487ae1ea9522dd5411b
SHA512 4fe48c1f84725b25c3434f7659afffa378a3082ef22680d8a92d8edc161bd2b074db3a8c849eb308724069930efd630b0aac6a2dc819a329f9d0e2ea5e129311
SSDEEP 768:8EVZl6FhWr80/FKCr2bhuj/TV+wnAr2bhuCRQTV+wG:8G0hGNKS2hujEwnw2huGlwG
TLSH
T133C3C44F4299A073EB42DA7DD8859B050C60BDC9B9F458FB505EF23E3E3178E2B6405A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client32.ini

Path C:\Users\Admin\AppData\Roaming\ZRyf1B31\client32.ini
Size 721B
SHA256 5de41aab1d12ec756e30dfd65731b2d902656f338649ac2ada23df5424b49f4f
MD5 2d4fa883c03e4669ead20140167f66c5
SHA1 98c85c684e611eaec18b5b7365001a547f66d683
SHA512 f0fc7b44b12c6b795d64a439c779c2d1968a7727db0eb060f32d8973a9ef99582aedb2ed25264dc06b4abaef54004097f36eb25387d1a265fd307031b4c1f919
TLSH
T10801C012230BFD5C0E4FA2C5F8B544D46FD21180D15DB9204618AC4F5F356BD04EF868
MD5 SHA1 SHA512 TLSH

Submit Download

msvcr100.dll

Path C:\Users\Admin\AppData\Roaming\ZRyf1B31\msvcr100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcicapi.dll

Path C:\Users\Admin\AppData\Roaming\ZRyf1B31\pcicapi.dll
Size 32KB
SHA256 2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
MD5 34dfb87e4200d852d1fb45dc48f93cfc
SHA1 35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
SHA512 f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2
SSDEEP 768:JFvNhAyi5hHA448qZkSn+EgT8ToDXTVi0:JCyoHA448qSSzgIQb
TLSH
T1AEE27EC59A98A493F9C94C7570EEEB335C3D76B0675500D3B2A682A91ED83F2347821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads