| download: | /wp-content/lete.zip |
| Full analysis: | https://app.any.run/tasks/57d9b367-fa26-43a4-bf05-7943088c1c5f |
| Verdict: | Malicious activity |
| Threats: | NetSupport RAT is a malicious adaptation of the legitimate NetSupport Manager, a remote access tool used for IT support, which cybercriminals exploit to gain unauthorized control over systems. It has gained significant traction due to its sophisticated evasion techniques, widespread distribution campaigns, and the challenge it poses to security professionals who must distinguish between legitimate and malicious uses of the underlying software. |
| Analysis date: | April 28, 2025, 18:28:09 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=deflate |
| MD5: | FAF849107A0216C240D13C1367D3300D |
| SHA1: | 812B204366AD69D53B7280EBB4DDE70740FBCA9F |
| SHA256: | 9CB194ADCC2E8DB459BE8105AFCF6DABF2F709D7879C75815686CE69E38CA0AA |
| SSDEEP: | 98304:URjSAdyvGDkRHoeXuxXcTZKXh0qk0XIiBbz1SMR9+AHiZIDsVqht6uZViWXe7+78:uYW6w2 |
MALICIOUS
Executing a file with an untrusted certificate
- client32.exe (PID: 7552)
- client32.exe (PID: 8164)
NETSUPPORT mutex has been found
- client32.exe (PID: 7552)
- client32.exe (PID: 8164)
NETSUPPORT has been detected (YARA)
- client32.exe (PID: 7552)
NETSUPPORT has been detected (SURICATA)
- client32.exe (PID: 7552)
Connects to the CnC server
- client32.exe (PID: 7552)
SUSPICIOUS
The process drops C-runtime libraries
- WinRAR.exe (PID: 7084)
Process drops legitimate windows executable
- WinRAR.exe (PID: 7084)
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 7084)
Drop NetSupport executable file
- WinRAR.exe (PID: 7084)
There is functionality for taking screenshot (YARA)
- client32.exe (PID: 7552)
There is functionality for communication over UDP network (YARA)
- client32.exe (PID: 7552)
Connects to the server without a host name
- client32.exe (PID: 7552)
INFO
The sample compiled with english language support
- WinRAR.exe (PID: 7084)
Reads the computer name
- client32.exe (PID: 7552)
- client32.exe (PID: 8164)
Checks supported languages
- client32.exe (PID: 7552)
- client32.exe (PID: 8164)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 7084)
Manual execution by a user
- client32.exe (PID: 8164)
Reads the software policy settings
- slui.exe (PID: 6640)
- slui.exe (PID: 7240)
Checks proxy server information
- slui.exe (PID: 6640)
Reads Microsoft Office registry keys
- OpenWith.exe (PID: 5972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2023:06:21 08:51:24 |
| ZipCRC: | 0x4ef3825a |
| ZipCompressedSize: | 37676 |
| ZipUncompressedSize: | 78840 |
| ZipFileName: | AudioCapture.dll |
Total processes
143
Monitored processes
8
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 5972 | C:\WINDOWS\system32\OpenWith.exe -Embedding | C:\Windows\System32\OpenWith.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Pick an app Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6640 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7084 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\lete.zip | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 7208 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7240 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7552 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\client32.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\client32.exe | WinRAR.exe | ||||||||||||
User: admin Company: NetSupport Ltd Integrity Level: MEDIUM Description: NetSupport Client Application Version: V11.30 Modules
| |||||||||||||||
| 8060 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 8164 | "C:\Users\admin\Desktop\client32.exe" | C:\Users\admin\Desktop\client32.exe | explorer.exe | ||||||||||||
User: admin Company: NetSupport Ltd Integrity Level: HIGH Description: NetSupport Client Application Exit code: 255 Version: V11.30 Modules
| |||||||||||||||
Total events
10 891
Read events
10 855
Write events
23
Delete events
13
Modification events
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\lete.zip | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths |
| Operation: | write | Name: | name |
Value: 256 | |||
| (PID) Process: | (7084) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
Executable files
72
Suspicious files
10
Text files
24
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\AudioCapture.dll | executable | |
MD5:2A82792F7B45D537EDFE58EB758C1197 | SHA256:05AA13A6C1D18F691E552F04A996960917202A322D0DACFD330E553AD56978ED | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\KBDTAM99.DLL | executable | |
MD5:CCC736781CF4A49F42CD07C703B3A18B | SHA256:000C4B5B50966634DF58078511794F83690D693FCCF2ACA5C970C20981B29556 | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\HTCTL32.DLL | executable | |
MD5:3EED18B47412D3F91A394AE880B56ED2 | SHA256:13A17F2AD9288AAC8941D895251604BEB9524FA3C65C781197841EE15480A13F | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\mprext.dll | executable | |
MD5:0EABD6AB464758F058FC039A47F61750 | SHA256:F96E8D99B736E4CE7997BB1DE65D88C32E16F1F725D8BD98F52C39A02969FD87 | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\WiaExtensionHost64.dll | executable | |
MD5:5D084613C0E5C8C3022D9E0F316B0E23 | SHA256:07BC4DC48D5D9BCC2CE52CA8A0F925CA021092DC34CB811E183CBC0D32E576BA | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\comcat.dll | executable | |
MD5:835FF05A3F5E16E0FE41E515EA398BD4 | SHA256:8DCFB1E6AA965DF4BD4C0551D03BDFD6472C80219ADA4671910958688FBB4AB6 | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\client32.exe | executable | |
MD5:FCE17B987F321DCE852C8A52116E7EB6 | SHA256:AFC45CC0DF7F7E481BFF45C6F62A6418B6AE4C8B474EC36113E05AB7CA7E2743 | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\ifsutilx.dll | executable | |
MD5:27A7213091CDA31E84967BEAD4D29BD1 | SHA256:42214053995B6188B2E20935CA8C92AF77639F0D5541A132920A5CBA2CFCBDE6 | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\getuname.dll | executable | |
MD5:91C68038BFC064EA8FB6D432ACD38EE0 | SHA256:68DE057C4175D4C94AFA2ACB2ABC1A9CCAC04A3CEB8E84C33F7F414BB8B0EEB6 | |||
| 7084 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.21301\client32.ini | text | |
MD5:B012E00D14185DCE565B74EAA0918A75 | SHA256:4B620E847B2A897794AED7E91C3E970B872F5B6582F121875FD8572C9A120D95 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
25
DNS requests
17
Threats
23
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
2104 | svchost.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
7552 | client32.exe | POST | 200 | 185.225.17.74:443 | http://185.225.17.74/fakeurl.htm | unknown | — | — | unknown |
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7552 | client32.exe | POST | 200 | 185.225.17.74:443 | http://185.225.17.74/fakeurl.htm | unknown | — | — | unknown |
7552 | client32.exe | POST | — | 185.225.17.74:443 | http://185.225.17.74/fakeurl.htm | unknown | — | — | unknown |
7840 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7840 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7552 | client32.exe | POST | — | 185.225.17.74:443 | http://185.225.17.74/fakeurl.htm | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4784 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
2104 | svchost.exe | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
7552 | client32.exe | 185.225.17.74:443 | — | MivoCloud SRL | RO | unknown |
6544 | svchost.exe | 20.190.160.22:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
7552 | client32.exe | Potentially Bad Traffic | ET INFO HTTP traffic on port 443 (POST) |
7552 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Checkin |
7552 | client32.exe | A Network Trojan was detected | REMOTE [ANY.RUN] NetSupport RAT |
7552 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Response |
7552 | client32.exe | Potentially Bad Traffic | ET INFO HTTP traffic on port 443 (POST) |
7552 | client32.exe | A Network Trojan was detected | REMOTE [ANY.RUN] NetSupport RAT |
7552 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Checkin |
7552 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Response |
7552 | client32.exe | Potentially Bad Traffic | ET INFO HTTP traffic on port 443 (POST) |
7552 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Checkin |