| download: | /wp-content/lete.zip |
| Full analysis: | https://app.any.run/tasks/57d9b367-fa26-43a4-bf05-7943088c1c5f |
| Verdict: | Malicious activity |
| Threats: | NetSupport RAT is a malicious adaptation of the legitimate NetSupport Manager, a remote access tool used for IT support, which cybercriminals exploit to gain unauthorized control over systems. It has gained significant traction due to its sophisticated evasion techniques, widespread distribution campaigns, and the challenge it poses to security professionals who must distinguish between legitimate and malicious uses of the underlying software. |
| Analysis date: | April 28, 2025, 18:28:09 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=deflate |
| MD5: | FAF849107A0216C240D13C1367D3300D |
| SHA1: | 812B204366AD69D53B7280EBB4DDE70740FBCA9F |
| SHA256: | 9CB194ADCC2E8DB459BE8105AFCF6DABF2F709D7879C75815686CE69E38CA0AA |
| SSDEEP: | 98304:URjSAdyvGDkRHoeXuxXcTZKXh0qk0XIiBbz1SMR9+AHiZIDsVqht6uZViWXe7+78:uYW6w2 |
MALICIOUS
NETSUPPORT has been detected (YARA)
- client32.exe (PID: 7552)
NETSUPPORT mutex has been found
- client32.exe (PID: 7552)
- client32.exe (PID: 8164)
Connects to the CnC server
- client32.exe (PID: 7552)
Executing a file with an untrusted certificate
- client32.exe (PID: 8164)
- client32.exe (PID: 7552)
NETSUPPORT has been detected (SURICATA)
- client32.exe (PID: 7552)
SUSPICIOUS
Process drops legitimate windows executable
- WinRAR.exe (PID: 7084)
The process drops C-runtime libraries
- WinRAR.exe (PID: 7084)
Connects to the server without a host name
- client32.exe (PID: 7552)
Drop NetSupport executable file
- WinRAR.exe (PID: 7084)
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 7084)
There is functionality for taking screenshot (YARA)
- client32.exe (PID: 7552)
There is functionality for communication over UDP network (YARA)
- client32.exe (PID: 7552)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 7084)
The sample compiled with english language support
- WinRAR.exe (PID: 7084)
Manual execution by a user
- client32.exe (PID: 8164)
Checks supported languages
- client32.exe (PID: 7552)
- client32.exe (PID: 8164)
Reads the computer name
- client32.exe (PID: 7552)
- client32.exe (PID: 8164)
Reads the software policy settings
- slui.exe (PID: 7240)
- slui.exe (PID: 6640)
Checks proxy server information
- slui.exe (PID: 6640)
Reads Microsoft Office registry keys
- OpenWith.exe (PID: 5972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2023:06:21 08:51:24 |
| ZipCRC: | 0x4ef3825a |
| ZipCompressedSize: | 37676 |
| ZipUncompressedSize: | 78840 |
| ZipFileName: | AudioCapture.dll |
Total processes
143
Monitored processes
8
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 5972 | C:\WINDOWS\system32\OpenWith.exe -Embedding | C:\Windows\System32\OpenWith.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Pick an app Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6640 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7084 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\lete.zip | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 7208 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7240 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7552 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\client32.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\client32.exe | WinRAR.exe | ||||||||||||
User: admin Company: NetSupport Ltd Integrity Level: MEDIUM Description: NetSupport Client Application Version: V11.30 Modules
| |||||||||||||||
| 8060 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 8164 | "C:\Users\admin\Desktop\client32.exe" | C:\Users\admin\Desktop\client32.exe | explorer.exe | ||||||||||||
User: admin Company: NetSupport Ltd Integrity Level: HIGH Description: NetSupport Client Application Exit code: 255 Version: V11.30 Modules
| |||||||||||||||
Total events
10 891
Read events
10 855
Write events
23
Delete events
13
Modification events
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\lete.zip | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths |
| Operation: | write | Name: | name |
Value: 256 | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
Executable files
72
Suspicious files
10
Text files
24
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\Mss32.dll | executable | |
MD5:18A082AD2C18DF2556FEAC3E1055423F | SHA256:B59148EEB9CD967F6D69857A60FE384F881A2BF8E4F26183D0D4ED4679D42518 | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\KBDTAM99.DLL | executable | |
MD5:CCC736781CF4A49F42CD07C703B3A18B | SHA256:000C4B5B50966634DF58078511794F83690D693FCCF2ACA5C970C20981B29556 | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\NSM.LIC | text | |
MD5:866C96BA2823AC5FE70130DFAAA08531 | SHA256:6A7C99E4BD767433C25D6DF8DF81BAA99C05DD24FA064E45C306FF4D954E1921 | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\PCICL32.DLL | executable | |
MD5:1274CCA13CC5E37CA94D35E5B0673E89 | SHA256:CD5510C8BC7EA60BE77AD4AAB502EE02D871BF4E917AEEB6921C20EEBD9693DD | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\msidle.dll | executable | |
MD5:B1C1BB1EF2AC2D739AEAED77C33C1848 | SHA256:CD8D7CAEBFEB4EB9124BA3E025AFF68DDE554A8DD6B3365654BF936200C4E563 | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\AudioCapture.dll | executable | |
MD5:2A82792F7B45D537EDFE58EB758C1197 | SHA256:05AA13A6C1D18F691E552F04A996960917202A322D0DACFD330E553AD56978ED | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\NSM.ini | text | |
MD5:99F493DCE7FAB330DC47F0CAB8FE6172 | SHA256:E0ED36C897EAA5352FAB181C20020B60DF4C58986193D6AAF5BF3E3ECDC4C05D | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\msvcr100.dll | executable | |
MD5:0E37FBFA79D349D672456923EC5FBBE3 | SHA256:8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18 | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\HTCTL32.DLL | executable | |
MD5:3EED18B47412D3F91A394AE880B56ED2 | SHA256:13A17F2AD9288AAC8941D895251604BEB9524FA3C65C781197841EE15480A13F | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\comcat.dll | executable | |
MD5:835FF05A3F5E16E0FE41E515EA398BD4 | SHA256:8DCFB1E6AA965DF4BD4C0551D03BDFD6472C80219ADA4671910958688FBB4AB6 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
25
DNS requests
17
Threats
23
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2104 | svchost.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
7552 | client32.exe | POST | 200 | 185.225.17.74:443 | http://185.225.17.74/fakeurl.htm | unknown | — | — | unknown |
7552 | client32.exe | POST | — | 185.225.17.74:443 | http://185.225.17.74/fakeurl.htm | unknown | — | — | unknown |
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
7552 | client32.exe | POST | 200 | 185.225.17.74:443 | http://185.225.17.74/fakeurl.htm | unknown | — | — | unknown |
7840 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7552 | client32.exe | POST | — | 185.225.17.74:443 | http://185.225.17.74/fakeurl.htm | unknown | — | — | unknown |
7840 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4784 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
2104 | svchost.exe | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
7552 | client32.exe | 185.225.17.74:443 | — | MivoCloud SRL | RO | unknown |
6544 | svchost.exe | 20.190.160.22:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
7552 | client32.exe | Potentially Bad Traffic | ET INFO HTTP traffic on port 443 (POST) |
7552 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Checkin |
7552 | client32.exe | A Network Trojan was detected | REMOTE [ANY.RUN] NetSupport RAT |
7552 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Response |
7552 | client32.exe | Potentially Bad Traffic | ET INFO HTTP traffic on port 443 (POST) |
7552 | client32.exe | A Network Trojan was detected | REMOTE [ANY.RUN] NetSupport RAT |
7552 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Checkin |
7552 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Response |
7552 | client32.exe | Potentially Bad Traffic | ET INFO HTTP traffic on port 443 (POST) |
7552 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Checkin |