Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19-05-2024 15:04

General

  • Target

    ddb47c76c975930de12c689f7f6e9ac0_NeikiAnalytics.exe

  • Size

    35KB

  • MD5

    ddb47c76c975930de12c689f7f6e9ac0

  • SHA1

    d1f18205eb24dfe5af0ebe5250a64632d56056f8

  • SHA256

    bd638029b2c11a937fc9cd747e3b8804c8ae93e62eaa8b00b3fa2cf7cc2a23d5

  • SHA512

    114a2d41fe70af9c629daed4d9912ca7896f49e7954cad71c59f65b2672e5587a8e90622e6a0d24f0f983394525be0ffc090ef1ecb7c9b8decc29bc74c0506eb

  • SSDEEP

    768:j6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:e8Z0kA7FHlO2OwOTUtKjpB

Score
10/10

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ddb47c76c975930de12c689f7f6e9ac0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\ddb47c76c975930de12c689f7f6e9ac0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Windows\SysWOW64\omsecor.exe
        C:\Windows\System32\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1288
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          PID:1528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    35KB

    MD5

    856e31b1153c77956442e2685a7ef5ee

    SHA1

    155732cdc7644a295ec8c04240fdfc7c5717c805

    SHA256

    9d397d095137106b904862500df338eaf3f2162d022421341047f4054fed1064

    SHA512

    473a2f409140eefef46f55c56bea674cd7efb71fe314dcc19fed204680f38a06c20cbaf6d172e7f776813f59da5912bfb234ced95cafb1e1215d1d3ba6cd99ef

  • \Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    35KB

    MD5

    beb216940f507ddbd6b680f889165d65

    SHA1

    2ff2e890dbae4570636d2f3de8e46aacb618ba18

    SHA256

    6c11dc5d1827e34bfb0e47195753ca23732fcb02874df1bc308f6f09a89ac322

    SHA512

    8708ee138615fd00ff436d7ab56fe959ca1186d5d2196c1e8566f31c2f3da59b064d50994d3d7a71e7f8c4bb975f89e24905dbb85bc2e5aff8a6103032b76636

  • \Windows\SysWOW64\omsecor.exe

    Filesize

    35KB

    MD5

    a1b2224ad60e9dfeaf791675c5855ed0

    SHA1

    5ec04bd46880e9d00be86da9bc264875527b121f

    SHA256

    18093e8fd8c19ef382c7b7ae9a408539eabab9e9059078577f705f2c63fe9e51

    SHA512

    694d077b2efb96b810685bac810e16f4de3a7330699668d088631da581f368a6648abdd0cf6bf3fb21f297e4fdcbfda32d2daf9231027e387e41344015c924d1

  • memory/1044-9-0x00000000001B0000-0x00000000001DD000-memory.dmp

    Filesize

    180KB

  • memory/1044-0-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/1044-11-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/1288-37-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/1528-51-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/1528-48-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/1528-46-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2592-20-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2592-33-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2592-26-0x0000000000290000-0x00000000002BD000-memory.dmp

    Filesize

    180KB

  • memory/2592-23-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2592-13-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2592-14-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB