| File name: | c85067c3dd04ea09ad7bedd9636858b0NeikiAnalytics.exe |
| Full analysis: | https://app.any.run/tasks/4fb01ebb-8371-44a7-96f5-23b53d325082 |
| Verdict: | Malicious activity |
| Analysis date: | May 18, 2024, 15:43:01 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | C85067C3DD04EA09AD7BEDD9636858B0 |
| SHA1: | 11F83ACACE07A92A97CEC8BAAC0EA8F3817274C6 |
| SHA256: | 279D50173961A50C7F9E148BE3543052FA809F041AFEFAB11D152FF9BD418D66 |
| SSDEEP: | 1536:zQ5QuYcjhtQZD/Kj7auCqrJmeMqaQkPcy8WTeAw4Pp:c5QeUCzCqrDMYkPcy8qs4Pp |
| .exe | | | DOS Executable Generic (100) |
|---|
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2015:01:27 03:56:27+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 48128 |
| InitializedDataSize: | 274 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xc9d0 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | c:\5df89.exe | C:\5df89.exe | — | 0w2dp.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 208 | c:\wo5af.exe | C:\wo5af.exe | — | 8c5ji.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 232 | c:\l4o4t43.exe | C:\l4o4t43.exe | — | 002g51n.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 232 | c:\ewsdp98.exe | C:\ewsdp98.exe | — | u49qie.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 308 | c:\078s6ce.exe | C:\078s6ce.exe | m6i4n5.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 308 | c:\ov10e8.exe | C:\ov10e8.exe | iijwv.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 308 | c:\770w2j6.exe | C:\770w2j6.exe | — | co2djg2.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 308 | c:\tr1306.exe | C:\tr1306.exe | — | 7w6sd.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 308 | c:\30gee.exe | C:\30gee.exe | — | e0408.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 308 | c:\wf96u4u.exe | C:\wf96u4u.exe | — | kso111.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| (PID) Process: | (6336) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6336) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (6336) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (6336) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6336 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms | — | |
MD5:— | SHA256:— | |||
| 6620 | g4v5g.exe | C:\664so9.exe | executable | |
MD5:7CB0D8A09B35C801A6281A1B20ACEE37 | SHA256:F52F610E7F3349455EDFA0D00B731B46D7D02BBF21E128FB212E129469AF3615 | |||
| 6700 | s3970.exe | C:\022671.exe | executable | |
MD5:FEC7C56DD520212FD50D513502A2AE7F | SHA256:0081749A8A936A8FB5EC2E7DD199A864C05FD9FA6CDF3E19AC636A7F824269E2 | |||
| 6336 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_z1qrzm0x.xac.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6336 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W27TFYQW3E8L7CIZSWC2.temp | binary | |
MD5:1E4379174AA1581A7F94EDCE44C054EA | SHA256:1D2415C20CFBCC5F3946BF0C3D4072D0752C21E12C051D654BDB1AC24D13957C | |||
| 6640 | 664so9.exe | C:\0c8090.exe | executable | |
MD5:9540AD0A5D675304E0B58802E0039A1A | SHA256:28ADF2E8CDBA96A3B4F7A590CCB18BDB2F5B6BAD162D9B2FB305C10CE2BC4405 | |||
| 6592 | c85067c3dd04ea09ad7bedd9636858b0NeikiAnalytics.exe | C:\g4v5g.exe | executable | |
MD5:CAE9BA5B92562099E27E70D5E60AC657 | SHA256:2B6D1B775E36BFE00D25B61B0936435AFB93556F5244736F2FFE62D8BBBC9ED6 | |||
| 6336 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:7AE5F51F4B1BDC2CA244E246DE25122A | SHA256:D8F118A0B376660FE22780B65531A77835AD1BB0CB4EBB5732C03E0B8323DC77 | |||
| 6812 | t3v0p.exe | C:\27j641i.exe | executable | |
MD5:0E1BD2D7DEB909893C7A874E2DC51E92 | SHA256:F8933B7FC34B262570E17B3488B4614FF23954E1F772E2D06C7C76C43CE6CA32 | |||
| 6876 | xpr1gc8.exe | C:\9qo7cj.exe | executable | |
MD5:D23443B4FE9BCFDAD6B360451E2CABC6 | SHA256:E792101F5F1D8A9790237D9368FCFF99C097B4E51B1A6D32E0015E28A505FCBD | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
528 | svchost.exe | GET | 200 | 2.16.164.120:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
5140 | MoUsoCoreWorker.exe | GET | 200 | 2.16.164.120:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
5380 | RUXIMICS.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
5380 | RUXIMICS.exe | GET | 200 | 2.16.164.120:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
— | — | POST | 200 | 20.42.65.91:443 | https://self.events.data.microsoft.com/OneCollector/1.0/ | unknown | binary | 9 b | — |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | unknown |
4364 | svchost.exe | 239.255.255.250:1900 | — | — | — | unknown |
528 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5140 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5380 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
528 | svchost.exe | 2.16.164.120:80 | crl.microsoft.com | Akamai International B.V. | NL | unknown |
5380 | RUXIMICS.exe | 2.16.164.120:80 | crl.microsoft.com | Akamai International B.V. | NL | unknown |
5140 | MoUsoCoreWorker.exe | 2.16.164.120:80 | crl.microsoft.com | Akamai International B.V. | NL | unknown |
5380 | RUXIMICS.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | unknown |
5456 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |