Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 15:22
Behavioral task
behavioral1
Sample
e21334854c1732db05619261c709c470_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
e21334854c1732db05619261c709c470_NeikiAnalytics.exe
-
Size
84KB
-
MD5
e21334854c1732db05619261c709c470
-
SHA1
85e1cf5b14a2440f0987f7cf9d10bd6cc84f02c7
-
SHA256
f0fa8801dd3c886a8aef5868150964c5a99ea506cf8fd30afeae39e281dc8749
-
SHA512
812efa3b2fcebe8d96e502e3d8795a04d761765bbe58bd23bf69ef66ef450fe6e28be377434306600cea47e07a966b63ee9f22cb26d6edc8eb33a6654ffd7306
-
SSDEEP
768:6MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:6bIvYvZEyFKF6N4yS+AQmZTl/5
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
omsecor.exeomsecor.exeomsecor.exepid process 2008 omsecor.exe 1808 omsecor.exe 2004 omsecor.exe -
Loads dropped DLL 6 IoCs
Processes:
e21334854c1732db05619261c709c470_NeikiAnalytics.exeomsecor.exeomsecor.exepid process 2776 e21334854c1732db05619261c709c470_NeikiAnalytics.exe 2776 e21334854c1732db05619261c709c470_NeikiAnalytics.exe 2008 omsecor.exe 2008 omsecor.exe 1808 omsecor.exe 1808 omsecor.exe -
Drops file in System32 directory 1 IoCs
Processes:
omsecor.exedescription ioc process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e21334854c1732db05619261c709c470_NeikiAnalytics.exeomsecor.exeomsecor.exedescription pid process target process PID 2776 wrote to memory of 2008 2776 e21334854c1732db05619261c709c470_NeikiAnalytics.exe omsecor.exe PID 2776 wrote to memory of 2008 2776 e21334854c1732db05619261c709c470_NeikiAnalytics.exe omsecor.exe PID 2776 wrote to memory of 2008 2776 e21334854c1732db05619261c709c470_NeikiAnalytics.exe omsecor.exe PID 2776 wrote to memory of 2008 2776 e21334854c1732db05619261c709c470_NeikiAnalytics.exe omsecor.exe PID 2008 wrote to memory of 1808 2008 omsecor.exe omsecor.exe PID 2008 wrote to memory of 1808 2008 omsecor.exe omsecor.exe PID 2008 wrote to memory of 1808 2008 omsecor.exe omsecor.exe PID 2008 wrote to memory of 1808 2008 omsecor.exe omsecor.exe PID 1808 wrote to memory of 2004 1808 omsecor.exe omsecor.exe PID 1808 wrote to memory of 2004 1808 omsecor.exe omsecor.exe PID 1808 wrote to memory of 2004 1808 omsecor.exe omsecor.exe PID 1808 wrote to memory of 2004 1808 omsecor.exe omsecor.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e21334854c1732db05619261c709c470_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e21334854c1732db05619261c709c470_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
PID:2004
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD54a2df8bbd31bdf906b0ef5ea1cdb77b4
SHA18b37054650ba1044fb429d6e02e2cb39767bd61f
SHA256827bdb0adc2996097261a28764779414041feffd5b3dbe88dfe30da10e22f755
SHA51271a08453c6233d5aa2909e856ccda6f88b3f45a1524c004aabf8df994b32e1b9e84fc1657e919fe6d3620c36507ce4ab8857f2ab82aa12df40e9456afc0a2ce4
-
Filesize
84KB
MD532cc87bde43d7c374c0ac13e8539626f
SHA120bcd4bff8edb0b01cfccd821944ce84f1311d50
SHA2564300531192fa8e0e9f267a8af9866263801fd8384fd119aa981ab934ce7e923d
SHA51209858ae81dd4eb4217f9606d00ce4cb86924b636d221e69c443809197c8a8cb79adf83cb80dffc86916902e692209d1939655bc26e262169db2397bb55420150
-
Filesize
84KB
MD5b4d151e572e944eedf3ca3d78b7b52a4
SHA1e85834833ef5a9f45f6aac64c3209e403040d577
SHA25601b89e52a9fa155de25475cf11ea481cf0b9d791c6696f285c6d37307d8cbee6
SHA51240595473f8178636cc50fdfe4aa84e30d6099d0753053263621d463fc0057f63f7c4d8933bde1c2a1d6d0f5c8fa51857bcbb46c869f52ba0dbb029cae39e3fd7