| File name: | d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.zip |
| Full analysis: | https://app.any.run/tasks/3e7df0d0-137f-40a5-aa1d-b171f3d1296e |
| Verdict: | Malicious activity |
| Threats: | NetSupport RAT is a malicious adaptation of the legitimate NetSupport Manager, a remote access tool used for IT support, which cybercriminals exploit to gain unauthorized control over systems. It has gained significant traction due to its sophisticated evasion techniques, widespread distribution campaigns, and the challenge it poses to security professionals who must distinguish between legitimate and malicious uses of the underlying software. |
| Analysis date: | December 24, 2024, 19:19:27 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v5.1 to extract, compression method=AES Encrypted |
| MD5: | 3B66F83DA5B1445061D6838E0EECAFAA |
| SHA1: | 9A2BACF85772DFB132618D4F5281AC06BDF76EBA |
| SHA256: | 83B3A577D8AD20AE80182FC453191E6E7C6E25811EA0E1042DB89046C736E9D6 |
| SSDEEP: | 98304:+llG7WAjxEf0dx4UPEt08DAxAV3si9bGliCWW2AvtUzb96DjXyHYccENb/r3LHhj:3cKqhP1 |
MALICIOUS
Generic archive extractor
- WinRAR.exe (PID: 6160)
Changes the autorun value in the registry
- reg.exe (PID: 6692)
- reg.exe (PID: 2436)
NETSUPPORT mutex has been found
- bild.exe (PID: 244)
Connects to the CnC server
- bild.exe (PID: 244)
NETSUPPORT has been detected (SURICATA)
- bild.exe (PID: 244)
SUSPICIOUS
The process drops C-runtime libraries
- d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe (PID: 6292)
Executable content was dropped or overwritten
- d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe (PID: 6292)
Drop NetSupport executable file
- d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe (PID: 6292)
Process drops legitimate windows executable
- d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe (PID: 6292)
Reads security settings of Internet Explorer
- d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe (PID: 6292)
- bild.exe (PID: 244)
Starts CMD.EXE for commands execution
- d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe (PID: 6292)
Likely accesses (executes) a file from the Public directory
- cmd.exe (PID: 6152)
- reg.exe (PID: 6692)
- reg.exe (PID: 2436)
- bild.exe (PID: 244)
Executing commands from a ".bat" file
- d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe (PID: 6292)
Uses REG/REGEDIT.EXE to modify registry
- cmd.exe (PID: 6152)
Contacting a server suspected of hosting an CnC
- bild.exe (PID: 244)
Potential Corporate Privacy Violation
- bild.exe (PID: 244)
INFO
Manual execution by a user
- d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe (PID: 6292)
The process uses the downloaded file
- WinRAR.exe (PID: 6160)
- d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe (PID: 6292)
Reads the computer name
- d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe (PID: 6292)
- bild.exe (PID: 244)
The sample compiled with english language support
- d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe (PID: 6292)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 6160)
Checks supported languages
- d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe (PID: 6292)
- bild.exe (PID: 244)
Process checks computer location settings
- d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe (PID: 6292)
Checks proxy server information
- bild.exe (PID: 244)
Creates files or folders in the user directory
- bild.exe (PID: 244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 51 |
|---|---|
| ZipBitFlag: | 0x0003 |
| ZipCompression: | Unknown (99) |
| ZipModifyDate: | 2024:12:24 17:54:40 |
| ZipCRC: | 0x9793b781 |
| ZipCompressedSize: | 2014529 |
| ZipUncompressedSize: | 2138135 |
| ZipFileName: | d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe |
Total processes
137
Monitored processes
7
Malicious processes
3
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 244 | C:\Users\Public\Netstat\bild.exe | C:\Users\Public\Netstat\bild.exe | cmd.exe | ||||||||||||
User: admin Company: NetSupport Ltd Integrity Level: HIGH Description: NetSupport Client Application Version: V12.10 Modules
| |||||||||||||||
| 2216 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2436 | REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe" | C:\Windows\SysWOW64\reg.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6152 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" " | C:\Windows\SysWOW64\cmd.exe | — | d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6160 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.zip | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 6292 | "C:\Users\admin\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe" | C:\Users\admin\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 6692 | REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe" | C:\Windows\SysWOW64\reg.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
2 403
Read events
2 379
Write events
24
Delete events
0
Modification events
| (PID) Process: | (6160) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (6160) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (6160) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (6160) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.zip | |||
| (PID) Process: | (6160) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (6160) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (6160) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (6160) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (6160) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
| (PID) Process: | (6160) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths |
| Operation: | write | Name: | name |
Value: 256 | |||
Executable files
9
Suspicious files
1
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6292 | d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe | C:\Users\Public\Netstat\nskbfltr.inf | binary | |
MD5:26E28C01461F7E65C402BDF09923D435 | SHA256:D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368 | |||
| 6292 | d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe | C:\Users\Public\Netstat\bild.exe | executable | |
MD5:8D9709FF7D9C83BD376E01912C734F0A | SHA256:49A568F8AC11173E3A0D76CFF6BC1D4B9BDF2C35C6D8570177422F142DCFDBE3 | |||
| 6292 | d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe | C:\Users\Public\Netstat\PCICL32.DLL | executable | |
MD5:00587238D16012152C2E951A087F2CC9 | SHA256:63AA18C32AF7144156E7EE2D5BA0FA4F5872A7DEB56894F6F96505CBC9AFE6F8 | |||
| 6292 | d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe | C:\Users\Public\Netstat\client32.ini | text | |
MD5:0F81A0520491093CA88F974D4FBAFE11 | SHA256:2C27FB0A37F8BDFCCE98DAB852DEE3C2950C9810394A441A19ECE63C64DAF818 | |||
| 6292 | d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe | C:\Users\Public\Netstat\netsup.bat | text | |
MD5:7604BB3E3698A7074FF39ECA4195391F | SHA256:FE14D5B612CC516A7DDE97E3FE93FE35573F808B036E9C9513FCEADCB1BCC751 | |||
| 6292 | d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe | C:\Users\Public\Netstat\pcicapi.dll | executable | |
MD5:DCDE2248D19C778A41AA165866DD52D0 | SHA256:9074FD40EA6A0CAA892E6361A6A4E834C2E51E6E98D1FFCDA7A9A537594A6917 | |||
| 6292 | d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe | C:\Users\Public\Netstat\NSM.LIC | text | |
MD5:7067AF414215EE4C50BFCD3EA43C84F0 | SHA256:2050CC232710A2EA6A207BC78D1EAC66A4042F2EE701CDFEEE5DE3DDCDC31D12 | |||
| 6292 | d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe | C:\Users\Public\Netstat\remcmdstub.exe | executable | |
MD5:325B65F171513086438952A152A747C4 | SHA256:26DBB528C270C812423C3359FC54D13C52D459CC0E8BC9B0D192725EDA34E534 | |||
| 6292 | d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe | C:\Users\Public\Netstat\TCCTL32.DLL | executable | |
MD5:EAB603D12705752E3D268D86DFF74ED4 | SHA256:6795D760CE7A955DF6C2F5A062E296128EFDB8C908908EDA4D666926980447EA | |||
| 6292 | d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d582b6d0b6f188306954.exe | C:\Users\Public\Netstat\PCICHEK.DLL | executable | |
MD5:A0B9388C5F18E27266A31F8C5765B263 | SHA256:313117E723DDA6EA3911FAACD23F4405003FB651C73DE8DEFF10B9EB5B4A058A | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
34
DNS requests
17
Threats
15
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
244 | bild.exe | GET | 200 | 104.26.0.231:80 | http://geo.netsupportsoftware.com/location/loca.asp | unknown | — | — | malicious |
244 | bild.exe | POST | 200 | 45.76.253.210:443 | http://45.76.253.210/fakeurl.htm | unknown | — | — | malicious |
5064 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
244 | bild.exe | POST | 200 | 45.76.253.210:443 | http://45.76.253.210/fakeurl.htm | unknown | — | — | malicious |
5640 | SIHClient.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
512 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4712 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5064 | SearchApp.exe | 2.23.209.193:443 | www.bing.com | Akamai International B.V. | GB | whitelisted |
1176 | svchost.exe | 20.190.159.4:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1176 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
go.microsoft.com |
| unknown |
geo.netsupportsoftware.com |
| unknown |
arc.msn.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potential Corporate Privacy Violation | ET POLICY NetSupport GeoLocation Lookup Request |
— | — | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
— | — | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
— | — | Misc activity | ET INFO NetSupport Remote Admin Checkin |
— | — | Misc activity | ET INFO NetSupport Remote Admin Response |
— | — | Misc activity | ET INFO NetSupport Remote Admin Checkin |
— | — | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
— | — | Misc activity | ET INFO NetSupport Remote Admin Checkin |
— | — | Misc activity | ET INFO NetSupport Remote Admin Response |
— | — | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
4 ETPRO signatures available at the full report