| File name: | Neos Email Spoofer.exe |
| Full analysis: | https://app.any.run/tasks/071ab667-f4bf-4bf1-a62c-17e503c69266 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | August 20, 2024, 08:24:59 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows |
| MD5: | 05CFAC0B4CC758DFC4C7992215F9C390 |
| SHA1: | 513E6654E517D7CF73B4CB267FF7F2E9BEDA9EF6 |
| SHA256: | 69AB2837892A6066DCD40C99607E78A2A6F51A3F3E3B7FDFE759C0A5E98E1198 |
| SSDEEP: | 49152:vV7S/Ja52CmTwWvOFfkvS7bWqzp6XRLklgg:d7+hFeMSNIRK |
| .exe | | | Win64 Executable (generic) (61.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (14.6) |
| .exe | | | Win32 Executable (generic) (10) |
| .exe | | | Win16/32 Executable Delphi generic (4.6) |
| .exe | | | Generic Win/DOS Executable (4.4) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 0000:00:00 00:00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 2048 |
| InitializedDataSize: | 1554944 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1475 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Unknown (0) |
| ObjectFileType: | Unknown |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Neos07 |
| FileTitle: | Neos Email Spoofer.exe |
| FileDescription: | Neos Email Spoofer |
| FileVersion: | 1,0,0,0 |
| LegalCopyright: | Neos07 Copyright © 2015 |
| LegalTrademark: | - |
| ProductName: | Neos Email Spoofer |
| ProductVersion: | 1,0,0,0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 236 | schtasks /create /tn "SystemServicesTools" /tr "" /sc onstart /f | C:\Windows\System32\schtasks.exe | — | zwg.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Task Scheduler Configuration Tool Exit code: 2147500037 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 236 | C:\WINDOWS\system32\relog.exe | C:\Windows\System32\relog.exe | — | zwg.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Performance Relogging Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 236 | C:\WINDOWS\system32\relog.exe | C:\Windows\System32\relog.exe | — | zwg.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Performance Relogging Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) | |||||||||||||||
| 236 | "C:\Users\admin\AppData\Local\Temp\zwg.exe" | C:\Users\admin\AppData\Local\Temp\zwg.exe | — | Neos Email Spoofer.exe | |||||||||||
User: admin Company: Microsoft Integrity Level: MEDIUM Description: Services.exe Exit code: 0 Version: 1.2.0.1 | |||||||||||||||
| 236 | "C:\Users\admin\AppData\Local\Temp\zwg.exe" | C:\Users\admin\AppData\Local\Temp\zwg.exe | — | Neos Email Spoofer.exe | |||||||||||
User: admin Company: Microsoft Integrity Level: MEDIUM Description: Services.exe Exit code: 0 Version: 1.2.0.1 | |||||||||||||||
| 240 | "C:\Users\admin\AppData\Local\Temp\zwg.exe" | C:\Users\admin\AppData\Local\Temp\zwg.exe | — | Neos Email Spoofer.exe | |||||||||||
User: admin Company: Microsoft Integrity Level: MEDIUM Description: Services.exe Exit code: 0 Version: 1.2.0.1 Modules
| |||||||||||||||
| 240 | "C:\Users\admin\AppData\Local\Temp\zwg.exe" | C:\Users\admin\AppData\Local\Temp\zwg.exe | — | Neos Email Spoofer.exe | |||||||||||
User: admin Company: Microsoft Integrity Level: MEDIUM Description: Services.exe Exit code: 0 Version: 1.2.0.1 | |||||||||||||||
| 240 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | schtasks.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) | |||||||||||||||
| 240 | "C:\Users\admin\AppData\Local\Temp\zwg.exe" | C:\Users\admin\AppData\Local\Temp\zwg.exe | — | Neos Email Spoofer.exe | |||||||||||
User: admin Company: Microsoft Integrity Level: MEDIUM Description: Services.exe Exit code: 0 Version: 1.2.0.1 | |||||||||||||||
| 252 | "C:\Users\admin\Desktop\Neos Email Spoofer.exe" | C:\Users\admin\Desktop\Neos Email Spoofer.exe | — | Neos Email Spoofer.exe | |||||||||||
User: admin Company: Neos07 Integrity Level: MEDIUM Description: Neos Email Spoofer Exit code: 0 Version: 1,0,0,0 | |||||||||||||||
| (PID) Process: | (6560) Neos Email Spoofer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6560) Neos Email Spoofer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (6560) Neos Email Spoofer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (6560) Neos Email Spoofer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (6604) zwg.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Services |
Value: C:\Users\admin\AppData\Roaming\{2F33566DA0B91573532102}\{2F33566DA0B91573532102}.exe | |||
| (PID) Process: | (6624) Neos Email Spoofer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6624) Neos Email Spoofer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (6624) Neos Email Spoofer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (6624) Neos Email Spoofer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (6748) Neos Email Spoofer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6604 | zwg.exe | C:\Users\admin\AppData\Roaming\{2F33566DA0B91573532102}\{2F33566DA0B91573532102}.exe | executable | |
MD5:C1E4BBC07EDCD498C3237C435A2479B8 | SHA256:410BBD43E9FE61CFD4DC8A903F016CB0B50E5EFCD49CFBA0BCC2A93FC9C50155 | |||
| 6860 | relog.exe | C:\Users\admin\AppData\Local\Temp\SystemUpdate.exe | executable | |
MD5:0056EDCB3B1DA520131AE5FF4B093CEB | SHA256:459D228BB2E9E11064A79672EC8071417BE56FFFD906F5310F64E31B79E87B51 | |||
| 6732 | zwg.exe | C:\Users\admin\AppData\Local\Temp\THDBE6.tmp | binary | |
MD5:E33D3F3085D204B6FA006C145C4510AF | SHA256:2E9EDD0BD335BDD1AF7B098FCC8BD331F4E03F81CDF5B2BD06CE576FB5D38AFB | |||
| 6560 | Neos Email Spoofer.exe | C:\Users\admin\AppData\Local\Temp\zwg.exe | executable | |
MD5:C1E4BBC07EDCD498C3237C435A2479B8 | SHA256:410BBD43E9FE61CFD4DC8A903F016CB0B50E5EFCD49CFBA0BCC2A93FC9C50155 | |||
| 7076 | zwg.exe | C:\Users\admin\AppData\Local\Temp\THDCFF.tmp | binary | |
MD5:E33D3F3085D204B6FA006C145C4510AF | SHA256:2E9EDD0BD335BDD1AF7B098FCC8BD331F4E03F81CDF5B2BD06CE576FB5D38AFB | |||
| 6860 | relog.exe | C:\Users\admin\AppData\Roaming\Adobe\Service_Adobe.exe | executable | |
MD5:0056EDCB3B1DA520131AE5FF4B093CEB | SHA256:459D228BB2E9E11064A79672EC8071417BE56FFFD906F5310F64E31B79E87B51 | |||
| 6860 | relog.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.js | text | |
MD5:B544D6183C9920CEBDA15C7519985ACA | SHA256:F0302B15990AE0C403A6380DF6CB6C9D95CF0D50206DFB3191C100633954A658 | |||
| 6888 | zwg.exe | C:\Users\admin\AppData\Local\Temp\THDC72.tmp | binary | |
MD5:E33D3F3085D204B6FA006C145C4510AF | SHA256:2E9EDD0BD335BDD1AF7B098FCC8BD331F4E03F81CDF5B2BD06CE576FB5D38AFB | |||
| 6860 | relog.exe | C:\Users\admin\AppData\Roaming\FileZilla\Service_FileZilla.exe | executable | |
MD5:0056EDCB3B1DA520131AE5FF4B093CEB | SHA256:459D228BB2E9E11064A79672EC8071417BE56FFFD906F5310F64E31B79E87B51 | |||
| 6860 | relog.exe | C:\Users\admin\AppData\Roaming\com.adobe.dunamis\Service_com.adobe.dunamis.exe | executable | |
MD5:0056EDCB3B1DA520131AE5FF4B093CEB | SHA256:459D228BB2E9E11064A79672EC8071417BE56FFFD906F5310F64E31B79E87B51 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6860 | relog.exe | GET | 200 | 176.111.174.140:80 | http://176.111.174.140/api/update.pack | unknown | — | — | malicious |
6860 | relog.exe | GET | 200 | 176.111.174.140:80 | http://176.111.174.140/api/update2.pack | unknown | — | — | malicious |
— | — | POST | 200 | 176.111.174.140:80 | http://176.111.174.140/api.php?{2F33566DA0B91573532102} | unknown | — | — | malicious |
6860 | relog.exe | GET | 200 | 176.111.174.140:80 | http://176.111.174.140/event.php | unknown | — | — | malicious |
4552 | explorer.exe | POST | 200 | 176.111.174.140:80 | http://176.111.174.140/api.php?{2F33566DA0B91573532102} | unknown | — | — | unknown |
4552 | explorer.exe | POST | 200 | 176.111.174.140:80 | http://176.111.174.140/api.php?{2F33566DA0B91573532102} | unknown | — | — | unknown |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
644 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3244 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3304 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6860 | relog.exe | 176.111.174.140:80 | — | Chang Way Technologies Co. Limited | RU | malicious |
— | — | 176.111.174.140:80 | — | Chang Way Technologies Co. Limited | RU | malicious |
4552 | explorer.exe | 176.111.174.140:80 | — | Chang Way Technologies Co. Limited | RU | malicious |
3260 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
644 | svchost.exe | 40.126.32.133:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
644 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
6860 | relog.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
6860 | relog.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
6860 | relog.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 30 |
6860 | relog.exe | Misc activity | ET INFO EXE - Served Inline HTTP |
6860 | relog.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
6860 | relog.exe | Misc activity | ET HUNTING Suspicious Windows Executable WriteProcessMemory |
6860 | relog.exe | Misc activity | ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) |
6860 | relog.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
Process | Message |
|---|---|
Neos Email Spoofer.exe | Invalid parameter passed to C runtime function.
|
Neos Email Spoofer.exe | Invalid parameter passed to C runtime function.
|
Neos Email Spoofer.exe | Invalid parameter passed to C runtime function.
|
Neos Email Spoofer.exe | Invalid parameter passed to C runtime function.
|
Neos Email Spoofer.exe | Invalid parameter passed to C runtime function.
|
Neos Email Spoofer.exe | Invalid parameter passed to C runtime function.
|
Neos Email Spoofer.exe | Invalid parameter passed to C runtime function.
|
Neos Email Spoofer.exe | Invalid parameter passed to C runtime function.
|
Neos Email Spoofer.exe | Invalid parameter passed to C runtime function.
|
Neos Email Spoofer.exe | Invalid parameter passed to C runtime function.
|