File name:

svcservice.exe

Full analysis: https://app.any.run/tasks/dfbf4a8f-de3a-4135-93e3-992eb7d1a23a
Verdict: Malicious activity
Threats:

NetSupport RAT is a malicious adaptation of the legitimate NetSupport Manager, a remote access tool used for IT support, which cybercriminals exploit to gain unauthorized control over systems. It has gained significant traction due to its sophisticated evasion techniques, widespread distribution campaigns, and the challenge it poses to security professionals who must distinguish between legitimate and malicious uses of the underlying software.

Malware Trends Tracker     >>>
Analysis date: December 02, 2023, 17:51:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
netsupport
unwanted
remote
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

38075E9F13E3F8D2BD0F283C729B5F50

SHA1:

9666E1FB25F8EC4E9179E52511C1869CD5704BAE

SHA256:

0FDC3D43677D406FB68B434D25A5757F5981ECC19EC616F8DDCD9126BA548014

SSDEEP:

6144:2vxRnuEDpz0gdO6ahnzwy1/PJ2G4N5xUpHKWiK5:2/nuEDrdOfnzwKXkGOjYUK5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • svcservice.exe (PID: 1584)

    • NETSUPPORT has been detected (SURICATA)

      • client32.exe (PID: 2528)

    • Connects to the CnC server

      • client32.exe (PID: 2528)

  • SUSPICIOUS

    • Reads the Internet Settings

      • svcservice.exe (PID: 1584)
      • client32.exe (PID: 2528)

    • Reads settings of System Certificates

      • svcservice.exe (PID: 1584)

    • Reads security settings of Internet Explorer

      • svcservice.exe (PID: 1584)

    • Checks Windows Trust Settings

      • svcservice.exe (PID: 1584)

    • Process drops legitimate windows executable

      • svcservice.exe (PID: 1584)

    • The process drops C-runtime libraries

      • svcservice.exe (PID: 1584)

    • Connects to unusual port

      • client32.exe (PID: 2528)

    • Connects to the server without a host name

      • client32.exe (PID: 2528)

    • Adds/modifies Windows certificates

      • svcservice.exe (PID: 1584)

  • INFO

    • Reads the computer name

      • svcservice.exe (PID: 1584)
      • client32.exe (PID: 2528)

    • Checks proxy server information

      • client32.exe (PID: 2528)
      • svcservice.exe (PID: 1584)

    • Checks supported languages

      • svcservice.exe (PID: 1584)
      • client32.exe (PID: 2528)

    • Reads the machine GUID from the registry

      • svcservice.exe (PID: 1584)
      • client32.exe (PID: 2528)

    • Creates files or folders in the user directory

      • svcservice.exe (PID: 1584)
      • client32.exe (PID: 2528)

    • Drop NetSupport executable file

      • svcservice.exe (PID: 1584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:09:21 18:54:30+02:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 244224
InitializedDataSize: 3755520
UninitializedDataSize: -
EntryPoint: 0x56fd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 54.0.0.0
ProductVersionNumber: 50.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (0374)
CharacterSet: Unknown (85B3)
InternalName: ElasticAttrebas.exe
LegalTrademark1: DoesGet
OriginalFileName: Huklusa.exe
ProductName: Jsdgazfu
ProductVersion: 1.0.2.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start svcservice.exe #NETSUPPORT client32.exe

Process information

PID
CMD
Path
Indicators
Parent process
1584"C:\Users\admin\AppData\Local\Temp\svcservice.exe" C:\Users\admin\AppData\Local\Temp\svcservice.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\svcservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2528C:\Users\admin\AppData\Roaming\svcsrvce\client32.exeC:\Users\admin\AppData\Roaming\svcsrvce\client32.exe
svcservice.exe
User:
admin
Company:
NetSupport Ltd
Integrity Level:
MEDIUM
Description:
CrossTec Client Application
Exit code:
0
Version:
V11.00
Modules
Images
c:\users\admin\appdata\roaming\svcsrvce\client32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
1 146
Read events
1 111
Write events
33
Delete events
2

Modification events

(PID) Process:(1584) svcservice.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1584) svcservice.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1584) svcservice.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1584) svcservice.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1584) svcservice.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1584) svcservice.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1584) svcservice.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1584) svcservice.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1584) svcservice.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1584) svcservice.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349
Operation:writeName:Blob
Value:
1900000001000000100000002AA1C05E2AE606F198C2C5E937C97AA2030000000100000014000000D1EB23A46D17D68FD92564C2F1F1601764D8E3491D00000001000000100000002E0D6875874A44C820912E85E964CFDB140000000100000014000000A0110A233E96F107ECE2AF29EF82A57FD030A4B40B000000010000001C0000005300650063007400690067006F002000280041004100410029000000620000000100000020000000D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF453000000010000004300000030413022060C2B06010401B231010201050130123010060A2B0601040182373C0101030200C0301B060567810C010330123010060A2B0601040182373C0101030200C0090000000100000054000000305206082B0601050507030206082B06010505070303060A2B0601040182370A030406082B0601050507030406082B0601050507030606082B0601050507030706082B0601050507030106082B060105050703080F00000001000000140000003E8E6487F8FD27D322A269A71EDAAC5D57811286200000000100000036040000308204323082031AA003020102020101300D06092A864886F70D0101050500307B310B3009060355040613024742311B301906035504080C1247726561746572204D616E636865737465723110300E06035504070C0753616C666F7264311A3018060355040A0C11436F6D6F646F204341204C696D697465643121301F06035504030C18414141204365727469666963617465205365727669636573301E170D3034303130313030303030305A170D3238313233313233353935395A307B310B3009060355040613024742311B301906035504080C1247726561746572204D616E636865737465723110300E06035504070C0753616C666F7264311A3018060355040A0C11436F6D6F646F204341204C696D697465643121301F06035504030C1841414120436572746966696361746520536572766963657330820122300D06092A864886F70D01010105000382010F003082010A0282010100BE409DF46EE1EA76871C4D45448EBE46C883069DC12AFE181F8EE402FAF3AB5D508A16310B9A06D0C57022CD492D5463CCB66E68460B53EACB4C24C0BC724EEAF115AEF4549A120AC37AB23360E2DA8955F32258F3DEDCCFEF8386A28C944F9F68F29890468427C776BFE3CC352C8B5E07646582C048B0A891F9619F762050A891C766B5EB78620356F08A1A13EA31A31EA099FD38F6F62732586F07F56BB8FB142BAFB7AACCD6635F738CDA0599A838A8CB17783651ACE99EF4783A8DCF0FD942E2980CAB2F9F0E01DEEF9F9949F12DDFAC744D1B98B547C5E529D1F99018C7629CBE83C7267B3E8A25C7C0DD9DE6356810209D8FD8DED2C3849C0D5EE82FC90203010001A381C03081BD301D0603551D0E04160414A0110A233E96F107ECE2AF29EF82A57FD030A4B4300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF307B0603551D1F047430723038A036A0348632687474703A2F2F63726C2E636F6D6F646F63612E636F6D2F414141436572746966696361746553657276696365732E63726C3036A034A0328630687474703A2F2F63726C2E636F6D6F646F2E6E65742F414141436572746966696361746553657276696365732E63726C300D06092A864886F70D010105050003820101000856FC02F09BE8FFA4FAD67BC64480CE4FC4C5F60058CCA6B6BC1449680476E8E6EE5DEC020F60D68D50184F264E01E3E6B0A5EEBFBC745441BFFDFC12B8C74F5AF48960057F60B7054AF3F6F1C2BFC4B97486B62D7D6BCCD2F346DD2FC6E06AC3C334032C7D96DD5AC20EA70A99C1058BAB0C2FF35C3ACF6C37550987DE53406C58EFFCB6AB656E04F61BDC3CE05A15C69ED9F15948302165036CECE92173EC9B03A1E037ADA015188FFABA02CEA72CA910132CD4E50826AB229760F8905E74D4A29A53BDF2A968E0A26EC2D76CB1A30F9EBFEB68E756F2AEF2E32B383A0981B56B85D7BE2DED3F1AB7B263E2F5622C82D46A004150F139839F95E93696986E
Executable files
9
Suspicious files
4
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
1584svcservice.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQYU0XHJ\see1[1].zipcompressed
MD5:8BEA52677EB525163469E88990B711A5
SHA256:BBA2BD86AE87E53211B723F8452737F44A79BA1EB8E0F1D8D76B9E43E19B0793
1584svcservice.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\see1[1].htmhtml
MD5:1304294C0823CA486542BA408ED761E3
SHA256:3BBE72F3BAA8EC61DE17A1D767FCA58704769684B7ABE9161D0C4EAF4C8F0982
1584svcservice.exeC:\Users\admin\AppData\Roaming\svcsrvce\NSM.LICtext
MD5:B8BDFA6CA3FE9CBFC46824E8355C3622
SHA256:BE556BC2C58E56E6054EC017DF771CF086CB6E4BFEAFA5E6F2DA5E6068EE1262
1584svcservice.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\see2[1].htmhtml
MD5:1304294C0823CA486542BA408ED761E3
SHA256:3BBE72F3BAA8EC61DE17A1D767FCA58704769684B7ABE9161D0C4EAF4C8F0982
1584svcservice.exeC:\Users\admin\AppData\Roaming\svcsrvce\AudioCapture.dllexecutable
MD5:4182F37B9BA1FA315268C669B5335DDE
SHA256:A74612AE5234D1A8F1263545400668097F9EB6A01DFB8037BC61CA9CAE82C5B8
1584svcservice.exeC:\Users\admin\AppData\Roaming\svcsrvce\nsm_vpro.initext
MD5:3BE27483FDCDBF9EBAE93234785235E3
SHA256:4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
1584svcservice.exeC:\Users\admin\AppData\Roaming\svcsrvce\PCICHEK.DLLexecutable
MD5:A0B9388C5F18E27266A31F8C5765B263
SHA256:313117E723DDA6EA3911FAACD23F4405003FB651C73DE8DEFF10B9EB5B4A058A
1584svcservice.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQYU0XHJ\see3[1].zipcompressed
MD5:9135E247225ABFCF16962AD86B5C83EF
SHA256:4163AD735972EF401E05CB288616D604F92BD01CDC0246AD96A57DCB6EC2E6FA
1584svcservice.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2U1WPAC\see2[1].zipcompressed
MD5:51ADF72770A61B8F525AEC971133DD6E
SHA256:D3E55FFA0A063F9A3FE66CE394151819419DF68FD907EDC53B8A17ADB1AF4C02
1584svcservice.exeC:\Users\admin\AppData\Roaming\svcsrvce\PCICL32.DLLexecutable
MD5:AD51946B1659ED61B76FF4E599E36683
SHA256:07A191254362664B3993479A277199F7EA5EE723B6C25803914EEDB50250ACF4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
10
DNS requests
3
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1584
svcservice.exe
GET
301
195.35.38.36:80
http://andater393.net/see2.zip
unknown
html
707 b
unknown
2528
client32.exe
POST
200
46.149.74.125:1061
http://46.149.74.125/fakeurl.htm
unknown
binary
61 b
unknown
1584
svcservice.exe
GET
301
195.35.38.36:80
http://andater393.net/see1.zip
unknown
html
707 b
unknown
2528
client32.exe
GET
200
51.142.119.24:80
http://geo.netsupportsoftware.com/location/loca.asp
unknown
text
14 b
unknown
1584
svcservice.exe
GET
301
195.35.38.36:80
http://andater393.net/see3.zip
unknown
html
707 b
unknown
2528
client32.exe
POST
—
46.149.74.125:1061
http://46.149.74.125/fakeurl.htm
unknown
—
—
unknown
2528
client32.exe
POST
200
46.149.74.125:1061
http://46.149.74.125/fakeurl.htm
unknown
binary
151 b
unknown
2528
client32.exe
POST
—
46.149.74.125:1061
http://46.149.74.125/fakeurl.htm
unknown
—
—
unknown
2528
client32.exe
POST
—
46.149.74.125:1061
http://46.149.74.125/fakeurl.htm
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1584
svcservice.exe
195.35.38.36:80
andater393.net
—
US
unknown
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1584
svcservice.exe
195.35.38.36:443
andater393.net
—
US
unknown
2528
client32.exe
51.142.119.24:80
geo.netsupportsoftware.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
2528
client32.exe
46.149.74.125:1061
svanaten1.com
—
RU
unknown

DNS requests

Domain
IP
Reputation
andater393.net
  • 195.35.38.36
unknown
geo.netsupportsoftware.com
  • 51.142.119.24
  • 62.172.138.8
  • 62.172.138.67
unknown
svanaten1.com
  • 46.149.74.125
unknown

Threats

PID
Process
Class
Message
1584
svcservice.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
2528
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Checkin
2528
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Response
2528
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Checkin
2528
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Response
2528
client32.exe
Potential Corporate Privacy Violation
ET POLICY NetSupport GeoLocation Lookup Request
2528
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Checkin
2528
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Checkin
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
svcservice.exe