| File name: | c85067c3dd04ea09ad7bedd9636858b0NeikiAnalytics.exe |
| Full analysis: | https://app.any.run/tasks/4fb01ebb-8371-44a7-96f5-23b53d325082 |
| Verdict: | Malicious activity |
| Analysis date: | May 18, 2024, 15:43:01 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | C85067C3DD04EA09AD7BEDD9636858B0 |
| SHA1: | 11F83ACACE07A92A97CEC8BAAC0EA8F3817274C6 |
| SHA256: | 279D50173961A50C7F9E148BE3543052FA809F041AFEFAB11D152FF9BD418D66 |
| SSDEEP: | 1536:zQ5QuYcjhtQZD/Kj7auCqrJmeMqaQkPcy8WTeAw4Pp:c5QeUCzCqrDMYkPcy8qs4Pp |
| .exe | | | DOS Executable Generic (100) |
|---|
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2015:01:27 03:56:27+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 48128 |
| InitializedDataSize: | 274 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xc9d0 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | c:\5df89.exe | C:\5df89.exe | — | 0w2dp.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 208 | c:\wo5af.exe | C:\wo5af.exe | — | 8c5ji.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 232 | c:\l4o4t43.exe | C:\l4o4t43.exe | — | 002g51n.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 232 | c:\ewsdp98.exe | C:\ewsdp98.exe | — | u49qie.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 308 | c:\078s6ce.exe | C:\078s6ce.exe | m6i4n5.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 308 | c:\ov10e8.exe | C:\ov10e8.exe | iijwv.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 308 | c:\770w2j6.exe | C:\770w2j6.exe | — | co2djg2.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 308 | c:\tr1306.exe | C:\tr1306.exe | — | 7w6sd.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 308 | c:\30gee.exe | C:\30gee.exe | — | e0408.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 308 | c:\wf96u4u.exe | C:\wf96u4u.exe | — | kso111.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| (PID) Process: | (6336) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6336) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (6336) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (6336) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6336 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms | — | |
MD5:— | SHA256:— | |||
| 6620 | g4v5g.exe | C:\664so9.exe | executable | |
MD5:7CB0D8A09B35C801A6281A1B20ACEE37 | SHA256:F52F610E7F3349455EDFA0D00B731B46D7D02BBF21E128FB212E129469AF3615 | |||
| 6336 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_z1qrzm0x.xac.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6660 | 0c8090.exe | C:\0k208x.exe | executable | |
MD5:7FF9D4CC7A414720B5EBEAF24489BFCF | SHA256:3F24C7FC4DE08DA5A97718D57DF28C7A82FA61781EADA0ACF0BB4D0BDB5F81FB | |||
| 6792 | pt20ij.exe | C:\t3v0p.exe | executable | |
MD5:365B8C8FED2DA63863F870FE78E262FB | SHA256:2E810D1C58357E979952EFDD7DA39D312DEFFAF26DD47ACD2E0C89D965286B98 | |||
| 6740 | t54p7.exe | C:\m397r.exe | executable | |
MD5:65D0D8D1E75F0E5819A30270BE3A648F | SHA256:CB151C41CA07DC76FB2A84D02F09BA412D3A5878310A347D2AF396135C5BF862 | |||
| 6592 | c85067c3dd04ea09ad7bedd9636858b0NeikiAnalytics.exe | C:\g4v5g.exe | executable | |
MD5:CAE9BA5B92562099E27E70D5E60AC657 | SHA256:2B6D1B775E36BFE00D25B61B0936435AFB93556F5244736F2FFE62D8BBBC9ED6 | |||
| 6700 | s3970.exe | C:\022671.exe | executable | |
MD5:FEC7C56DD520212FD50D513502A2AE7F | SHA256:0081749A8A936A8FB5EC2E7DD199A864C05FD9FA6CDF3E19AC636A7F824269E2 | |||
| 6336 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:7AE5F51F4B1BDC2CA244E246DE25122A | SHA256:D8F118A0B376660FE22780B65531A77835AD1BB0CB4EBB5732C03E0B8323DC77 | |||
| 6856 | 0d4uxe.exe | C:\xpr1gc8.exe | executable | |
MD5:0ED15C5BAEB1699AD68F2684A5EAEC98 | SHA256:0F5EA3763F987B5F71C5A4C019885033035EC2E8957CF7F87688E225E81AA19E | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5140 | MoUsoCoreWorker.exe | GET | 200 | 2.16.164.120:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
528 | svchost.exe | GET | 200 | 2.16.164.120:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
5380 | RUXIMICS.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
5380 | RUXIMICS.exe | GET | 200 | 2.16.164.120:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
— | — | POST | 200 | 20.42.65.91:443 | https://self.events.data.microsoft.com/OneCollector/1.0/ | unknown | binary | 9 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | unknown |
4364 | svchost.exe | 239.255.255.250:1900 | — | — | — | unknown |
528 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5140 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5380 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
528 | svchost.exe | 2.16.164.120:80 | crl.microsoft.com | Akamai International B.V. | NL | unknown |
5380 | RUXIMICS.exe | 2.16.164.120:80 | crl.microsoft.com | Akamai International B.V. | NL | unknown |
5140 | MoUsoCoreWorker.exe | 2.16.164.120:80 | crl.microsoft.com | Akamai International B.V. | NL | unknown |
5380 | RUXIMICS.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | unknown |
5456 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |