NetSupport RAT: Phishing ZIP to Domain Compromise

An EDR alert flagged unusual scripting activity on a finance workstation this morning, and the identity team has separately reported an out-of-hours administrator logon to a domain controller. Before extracting indicators, orient yourself to the case so the pivots that follow make sense.

The earliest hostile event is an inbound email that failed sender authentication and carried an attachment. Determine the address the message was actually sent from.

Opening the attachment produced an unusual process launch on the workstation: a native scripting host ran a file from a temporary directory. Name the process that executed the dropper.

The script did not carry the payload itself. It launched a hidden PowerShell process that reached out to an external host and pulled down the remote-control package. Identify the domain the payload was downloaded from.

The downloaded tool was staged in AppData, persisted, and began calling home. Identify the primary gateway domain the remote-access client used for command-and-control.

After domain reconnaissance the operator moved to the domain controller over RDP and extracted the Active Directory credential database. Name the file that was copied off the domain controller.

The stolen database was archived and sent out of the network over a single encrypted channel. Identify the external IP address the data was exfiltrated to.

For the incident report, formally classify the technique the operator used to maintain hands-on-keyboard control: installing a legitimate remote-administration product and pointing it at attacker infrastructure. Provide the MITRE ATT&CK identifier.