File name:

svcservice.exe

Full analysis: https://app.any.run/tasks/dfbf4a8f-de3a-4135-93e3-992eb7d1a23a
Verdict: Malicious activity
Threats:

NetSupport RAT is a malicious adaptation of the legitimate NetSupport Manager, a remote access tool used for IT support, which cybercriminals exploit to gain unauthorized control over systems. It has gained significant traction due to its sophisticated evasion techniques, widespread distribution campaigns, and the challenge it poses to security professionals who must distinguish between legitimate and malicious uses of the underlying software.

Malware Trends Tracker     >>>
Analysis date: December 02, 2023, 17:51:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
netsupport
unwanted
remote
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

38075E9F13E3F8D2BD0F283C729B5F50

SHA1:

9666E1FB25F8EC4E9179E52511C1869CD5704BAE

SHA256:

0FDC3D43677D406FB68B434D25A5757F5981ECC19EC616F8DDCD9126BA548014

SSDEEP:

6144:2vxRnuEDpz0gdO6ahnzwy1/PJ2G4N5xUpHKWiK5:2/nuEDrdOfnzwKXkGOjYUK5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • svcservice.exe (PID: 1584)

    • Connects to the CnC server

      • client32.exe (PID: 2528)

    • NETSUPPORT has been detected (SURICATA)

      • client32.exe (PID: 2528)

  • SUSPICIOUS

    • Reads the Internet Settings

      • svcservice.exe (PID: 1584)
      • client32.exe (PID: 2528)

    • Reads settings of System Certificates

      • svcservice.exe (PID: 1584)

    • Checks Windows Trust Settings

      • svcservice.exe (PID: 1584)

    • Reads security settings of Internet Explorer

      • svcservice.exe (PID: 1584)

    • Adds/modifies Windows certificates

      • svcservice.exe (PID: 1584)

    • Process drops legitimate windows executable

      • svcservice.exe (PID: 1584)

    • The process drops C-runtime libraries

      • svcservice.exe (PID: 1584)

    • Connects to unusual port

      • client32.exe (PID: 2528)

    • Connects to the server without a host name

      • client32.exe (PID: 2528)

  • INFO

    • Checks supported languages

      • svcservice.exe (PID: 1584)
      • client32.exe (PID: 2528)

    • Reads the computer name

      • svcservice.exe (PID: 1584)
      • client32.exe (PID: 2528)

    • Checks proxy server information

      • svcservice.exe (PID: 1584)
      • client32.exe (PID: 2528)

    • Reads the machine GUID from the registry

      • svcservice.exe (PID: 1584)
      • client32.exe (PID: 2528)

    • Creates files or folders in the user directory

      • svcservice.exe (PID: 1584)
      • client32.exe (PID: 2528)

    • Drop NetSupport executable file

      • svcservice.exe (PID: 1584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:09:21 18:54:30+02:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 244224
InitializedDataSize: 3755520
UninitializedDataSize: -
EntryPoint: 0x56fd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 54.0.0.0
ProductVersionNumber: 50.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (0374)
CharacterSet: Unknown (85B3)
InternalName: ElasticAttrebas.exe
LegalTrademark1: DoesGet
OriginalFileName: Huklusa.exe
ProductName: Jsdgazfu
ProductVersion: 1.0.2.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start svcservice.exe #NETSUPPORT client32.exe

Process information

PID
CMD
Path
Indicators
Parent process
1584"C:\Users\admin\AppData\Local\Temp\svcservice.exe" C:\Users\admin\AppData\Local\Temp\svcservice.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\svcservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2528C:\Users\admin\AppData\Roaming\svcsrvce\client32.exeC:\Users\admin\AppData\Roaming\svcsrvce\client32.exe
svcservice.exe
User:
admin
Company:
NetSupport Ltd
Integrity Level:
MEDIUM
Description:
CrossTec Client Application
Exit code:
0
Version:
V11.00
Modules
Images
c:\users\admin\appdata\roaming\svcsrvce\client32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
1 146
Read events
1 111
Write events
33
Delete events
2

Modification events

(PID) Process:(1584) svcservice.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1584) svcservice.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1584) svcservice.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1584) svcservice.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1584) svcservice.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1584) svcservice.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1584) svcservice.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1584) svcservice.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1584) svcservice.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1584) svcservice.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349
Operation:writeName:Blob
Value:
1900000001000000100000002AA1C05E2AE606F198C2C5E937C97AA2030000000100000014000000D1EB23A46D17D68FD92564C2F1F1601764D8E3491D00000001000000100000002E0D6875874A44C820912E85E964CFDB140000000100000014000000A0110A233E96F107ECE2AF29EF82A57FD030A4B40B000000010000001C0000005300650063007400690067006F002000280041004100410029000000620000000100000020000000D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF453000000010000004300000030413022060C2B06010401B231010201050130123010060A2B0601040182373C0101030200C0301B060567810C010330123010060A2B0601040182373C0101030200C0090000000100000054000000305206082B0601050507030206082B06010505070303060A2B0601040182370A030406082B0601050507030406082B0601050507030606082B0601050507030706082B0601050507030106082B060105050703080F00000001000000140000003E8E6487F8FD27D322A269A71EDAAC5D57811286200000000100000036040000308204323082031AA003020102020101300D06092A864886F70D0101050500307B310B3009060355040613024742311B301906035504080C1247726561746572204D616E636865737465723110300E06035504070C0753616C666F7264311A3018060355040A0C11436F6D6F646F204341204C696D697465643121301F06035504030C18414141204365727469666963617465205365727669636573301E170D3034303130313030303030305A170D3238313233313233353935395A307B310B3009060355040613024742311B301906035504080C1247726561746572204D616E636865737465723110300E06035504070C0753616C666F7264311A3018060355040A0C11436F6D6F646F204341204C696D697465643121301F06035504030C1841414120436572746966696361746520536572766963657330820122300D06092A864886F70D01010105000382010F003082010A0282010100BE409DF46EE1EA76871C4D45448EBE46C883069DC12AFE181F8EE402FAF3AB5D508A16310B9A06D0C57022CD492D5463CCB66E68460B53EACB4C24C0BC724EEAF115AEF4549A120AC37AB23360E2DA8955F32258F3DEDCCFEF8386A28C944F9F68F29890468427C776BFE3CC352C8B5E07646582C048B0A891F9619F762050A891C766B5EB78620356F08A1A13EA31A31EA099FD38F6F62732586F07F56BB8FB142BAFB7AACCD6635F738CDA0599A838A8CB17783651ACE99EF4783A8DCF0FD942E2980CAB2F9F0E01DEEF9F9949F12DDFAC744D1B98B547C5E529D1F99018C7629CBE83C7267B3E8A25C7C0DD9DE6356810209D8FD8DED2C3849C0D5EE82FC90203010001A381C03081BD301D0603551D0E04160414A0110A233E96F107ECE2AF29EF82A57FD030A4B4300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF307B0603551D1F047430723038A036A0348632687474703A2F2F63726C2E636F6D6F646F63612E636F6D2F414141436572746966696361746553657276696365732E63726C3036A034A0328630687474703A2F2F63726C2E636F6D6F646F2E6E65742F414141436572746966696361746553657276696365732E63726C300D06092A864886F70D010105050003820101000856FC02F09BE8FFA4FAD67BC64480CE4FC4C5F60058CCA6B6BC1449680476E8E6EE5DEC020F60D68D50184F264E01E3E6B0A5EEBFBC745441BFFDFC12B8C74F5AF48960057F60B7054AF3F6F1C2BFC4B97486B62D7D6BCCD2F346DD2FC6E06AC3C334032C7D96DD5AC20EA70A99C1058BAB0C2FF35C3ACF6C37550987DE53406C58EFFCB6AB656E04F61BDC3CE05A15C69ED9F15948302165036CECE92173EC9B03A1E037ADA015188FFABA02CEA72CA910132CD4E50826AB229760F8905E74D4A29A53BDF2A968E0A26EC2D76CB1A30F9EBFEB68E756F2AEF2E32B383A0981B56B85D7BE2DED3F1AB7B263E2F5622C82D46A004150F139839F95E93696986E
Executable files
9
Suspicious files
4
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
1584svcservice.exeC:\Users\admin\AppData\Roaming\svcsrvce\client32.initext
MD5:B305601FC3799F9CFC32173853D80BF1
SHA256:9A4690636B68E3EF334CEA4BDDBF48C910FBADD5AFFDEE7B7BEE8736748270E7
1584svcservice.exeC:\Users\admin\AppData\Roaming\svcsrvce\remcmdstub.exeexecutable
MD5:35DA3B727567FAB0C7C8426F1261C7F5
SHA256:89027F1449BE9BA1E56DD82D13A947CB3CA319ADFE9782F4874FBDC26DC59D09
1584svcservice.exeC:\Users\admin\AppData\Roaming\svcsrvce\TCCTL32.DLLexecutable
MD5:405A7BCA024D33D7D6464129C1B58451
SHA256:092C3EC01883D3B4B131985B3971F7E2E523252B75F9C2470E0821505C4A3A83
1584svcservice.exeC:\Users\admin\AppData\Roaming\svcsrvce\nskbfltr.infbinary
MD5:26E28C01461F7E65C402BDF09923D435
SHA256:D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
1584svcservice.exeC:\Users\admin\AppData\Roaming\svcsrvce\PCICL32.DLLexecutable
MD5:AD51946B1659ED61B76FF4E599E36683
SHA256:07A191254362664B3993479A277199F7EA5EE723B6C25803914EEDB50250ACF4
1584svcservice.exeC:\Users\admin\AppData\Roaming\svcsrvce\NSM.LICtext
MD5:B8BDFA6CA3FE9CBFC46824E8355C3622
SHA256:BE556BC2C58E56E6054EC017DF771CF086CB6E4BFEAFA5E6F2DA5E6068EE1262
1584svcservice.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\see3[1].htmhtml
MD5:1304294C0823CA486542BA408ED761E3
SHA256:3BBE72F3BAA8EC61DE17A1D767FCA58704769684B7ABE9161D0C4EAF4C8F0982
1584svcservice.exeC:\Users\admin\AppData\Roaming\svcsrvce\pcicapi.dllexecutable
MD5:DCDE2248D19C778A41AA165866DD52D0
SHA256:9074FD40EA6A0CAA892E6361A6A4E834C2E51E6E98D1FFCDA7A9A537594A6917
1584svcservice.exeC:\Users\admin\AppData\Roaming\svcsrvce\AudioCapture.dllexecutable
MD5:4182F37B9BA1FA315268C669B5335DDE
SHA256:A74612AE5234D1A8F1263545400668097F9EB6A01DFB8037BC61CA9CAE82C5B8
1584svcservice.exeC:\Users\admin\AppData\Roaming\svcsrvce\msvcr100.dllexecutable
MD5:0E37FBFA79D349D672456923EC5FBBE3
SHA256:8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
10
DNS requests
3
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1584
svcservice.exe
GET
301
195.35.38.36:80
http://andater393.net/see1.zip
unknown
html
707 b
unknown
1584
svcservice.exe
GET
301
195.35.38.36:80
http://andater393.net/see2.zip
unknown
html
707 b
unknown
1584
svcservice.exe
GET
301
195.35.38.36:80
http://andater393.net/see3.zip
unknown
html
707 b
unknown
2528
client32.exe
GET
200
51.142.119.24:80
http://geo.netsupportsoftware.com/location/loca.asp
unknown
text
14 b
unknown
2528
client32.exe
POST
200
46.149.74.125:1061
http://46.149.74.125/fakeurl.htm
unknown
binary
61 b
unknown
2528
client32.exe
POST
200
46.149.74.125:1061
http://46.149.74.125/fakeurl.htm
unknown
binary
151 b
unknown
2528
client32.exe
POST
—
46.149.74.125:1061
http://46.149.74.125/fakeurl.htm
unknown
—
—
unknown
2528
client32.exe
POST
—
46.149.74.125:1061
http://46.149.74.125/fakeurl.htm
unknown
—
—
unknown
2528
client32.exe
POST
—
46.149.74.125:1061
http://46.149.74.125/fakeurl.htm
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1584
svcservice.exe
195.35.38.36:80
andater393.net
—
US
unknown
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1584
svcservice.exe
195.35.38.36:443
andater393.net
—
US
unknown
2528
client32.exe
51.142.119.24:80
geo.netsupportsoftware.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
2528
client32.exe
46.149.74.125:1061
svanaten1.com
—
RU
unknown

DNS requests

Domain
IP
Reputation
andater393.net
  • 195.35.38.36
unknown
geo.netsupportsoftware.com
  • 51.142.119.24
  • 62.172.138.8
  • 62.172.138.67
unknown
svanaten1.com
  • 46.149.74.125
unknown

Threats

PID
Process
Class
Message
1584
svcservice.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
2528
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Checkin
2528
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Response
2528
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Checkin
2528
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Response
2528
client32.exe
Potential Corporate Privacy Violation
ET POLICY NetSupport GeoLocation Lookup Request
2528
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Checkin
2528
client32.exe
Misc activity
ET INFO NetSupport Remote Admin Checkin
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
svcservice.exe