Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19-05-2024 22:28

General

  • Target

    4c1844acd093de809b95044c34eb5020_NeikiAnalytics.exe

  • Size

    35KB

  • MD5

    4c1844acd093de809b95044c34eb5020

  • SHA1

    f410b1a20a30d947c8a2b158520e0640779f51d2

  • SHA256

    0f4810f9b49d94e5262128a2456486b076734db252d2ca492463c8a21485ba53

  • SHA512

    ff2bcc8f8dbfa946bffc34f576672c3f16216f12605616d8093114725470388b0cb9961b31904a87128042eb95d75b4d0c16c5326140e98f0a09b5bc2afb1962

  • SSDEEP

    768:u6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:18Z0kA7FHlO2OwOTUtKjpB

Score
10/10

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c1844acd093de809b95044c34eb5020_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4c1844acd093de809b95044c34eb5020_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:820
      • C:\Windows\SysWOW64\omsecor.exe
        C:\Windows\System32\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2200
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    35KB

    MD5

    66039958bca2e90753432bb1bf87d4bf

    SHA1

    c09d28def543147c6d9c79f0e0385f69603f7af0

    SHA256

    c75dcd8e1415a859379125ee75a3a15e6070e10bb5fd7e35084c3b012ff3b9c3

    SHA512

    c2d42d76a22eb42982145307ce8a7c790851b8c9d957c383792beed6bd4b89db836c7d2835b8663eec4c204ba1661b20d90d46ab7e61a868270c9ff93994b345

  • \Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    35KB

    MD5

    7415a6f771a3f8d91363ff51fcd11f0d

    SHA1

    5cabdd2ec2c30ea092a4332a052dba85cb1932fa

    SHA256

    f9f0dea1531b980bc1e6a530122bc3051c3761a789644b20f9638c3d0cebaa8d

    SHA512

    6311e379eaabb5a667d717925bb565bb0c474ea22d01a318973387d42af4a29d52777da9e3b2294d00eab05b55a898ae1205cb0f86528d65286ea9844ea18661

  • \Windows\SysWOW64\omsecor.exe

    Filesize

    35KB

    MD5

    a090e46a638581aa9f8fe79fa907ca5f

    SHA1

    2a4fc879e30c9d6079d8e926c04580e98c66f63d

    SHA256

    8f0c8466e526069c808be2fe8dcc735389c5cfaf2f9345135c247016817a2f3d

    SHA512

    8ba041e825631e534925396f465d5f982b9267eb999fd4278ee88aca244bc393a8c5038d84b8fb520603d0badd4367c1751e0eca31f7445309b243ace4fa4ef5

  • memory/820-34-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/820-14-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/820-18-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/820-21-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/820-24-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/820-27-0x0000000000350000-0x000000000037D000-memory.dmp

    Filesize

    180KB

  • memory/1612-52-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/1612-49-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/1612-47-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2200-45-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/3000-10-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/3000-11-0x00000000003A0000-0x00000000003CD000-memory.dmp

    Filesize

    180KB

  • memory/3000-0-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/3000-9-0x00000000003A0000-0x00000000003CD000-memory.dmp

    Filesize

    180KB

  • memory/3000-16-0x00000000003A0000-0x00000000003CD000-memory.dmp

    Filesize

    180KB