Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-05-2024 16:44

General

  • Target

    f6a0b013d09974e204dea75b6b77ce90_NeikiAnalytics.exe

  • Size

    134KB

  • MD5

    f6a0b013d09974e204dea75b6b77ce90

  • SHA1

    df3bcaa3fad6d501f909fa7da71eee0d51bc0a0c

  • SHA256

    892b63b4b9488cc1c62d418da8b427719e392547338f175a9be072fd8bc2c619

  • SHA512

    475ca9bbde7339bf9548a8d696cd271fc755c49fcd7d3961d4b97dac29096961f7b94beea68797f62e8b447575f8d54534a4bbab9f9065ec260340cedbf03493

  • SSDEEP

    1536:PDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:7iRTeH0NqAW6J6f1tqF6dngNmaZC7M

Score
10/10

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Executes dropped EXE 6 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 4 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6a0b013d09974e204dea75b6b77ce90_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\f6a0b013d09974e204dea75b6b77ce90_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Users\Admin\AppData\Local\Temp\f6a0b013d09974e204dea75b6b77ce90_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\f6a0b013d09974e204dea75b6b77ce90_NeikiAnalytics.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4236
      • C:\Users\Admin\AppData\Roaming\omsecor.exe
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:404
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of WriteProcessMemory
          PID:4772
          • C:\Windows\SysWOW64\omsecor.exe
            C:\Windows\System32\omsecor.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3104
            • C:\Windows\SysWOW64\omsecor.exe
              C:\Windows\SysWOW64\omsecor.exe
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1076
              • C:\Users\Admin\AppData\Roaming\omsecor.exe
                C:\Users\Admin\AppData\Roaming\omsecor.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1492
                • C:\Users\Admin\AppData\Roaming\omsecor.exe
                  C:\Users\Admin\AppData\Roaming\omsecor.exe
                  8⤵
                  • Executes dropped EXE
                  PID:4584
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 256
                  8⤵
                  • Program crash
                  PID:3396
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 292
              6⤵
              • Program crash
              PID:1216
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 288
          4⤵
          • Program crash
          PID:3164
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 288
      2⤵
      • Program crash
      PID:1112
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2184 -ip 2184
    1⤵
      PID:4720
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 404 -ip 404
      1⤵
        PID:1568
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4036,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
        1⤵
          PID:4540
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3104 -ip 3104
          1⤵
            PID:4636
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1492 -ip 1492
            1⤵
              PID:4224

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Roaming\omsecor.exe

              Filesize

              134KB

              MD5

              aafd1724bc43e9a08389314b5d844e14

              SHA1

              fa2bf1876ee3a05611e96ee1dffacac472bc2792

              SHA256

              9d7c686545f4172665a6372000c92b9a3a74073ae6f7c08d25c1a681c50f3d4a

              SHA512

              c9f745cf32017cc1c9e956b6a71e10c2713f88b00293ab9fe680febc5cadebd3bb8745cc010089e40526e4b18ed8d5e9542e39a23340ba902a4509e2191f0e56

            • C:\Users\Admin\AppData\Roaming\omsecor.exe

              Filesize

              134KB

              MD5

              d4c6cd7c0b7cc06520db971df2b61b4c

              SHA1

              5843adf3b35e97e44e43f04c3341300119f67d90

              SHA256

              50c03ddc511cda534cac111ef1f3cd3cc944ff67bfc9a31ac6d1879259b92f7c

              SHA512

              6955708588efeca0e881e10e219d95f506fb8cca16370becfd234bca853b29bf0a7ee4ccd93252560377d37c39af092388ff25d543ad8c93f906bbca34d59f78

            • C:\Windows\SysWOW64\omsecor.exe

              Filesize

              134KB

              MD5

              92238cad262c15ca6e3b989b4f904901

              SHA1

              2d9debcd11c0ac6faaaf1996669cbe854237ca47

              SHA256

              351aa293a0808228de3116b6572a082b507928637f4f61ce590a5f8c4ad7bc1b

              SHA512

              95af30f15f7a521bb64235456b9b0ade084531de438debea62915a41356d7369c09b8188dc7731ca5de67db35c463d2b438752b18abb2437bbacae3391b2a355

            • memory/404-10-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/1076-35-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/1076-34-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/1076-40-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/1492-42-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/2184-16-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/2184-0-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/3104-29-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/3104-48-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/4236-1-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/4236-5-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/4236-2-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/4236-3-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/4584-52-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/4584-49-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/4584-47-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/4584-46-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/4772-23-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/4772-14-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/4772-15-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/4772-17-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/4772-20-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/4772-24-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/4772-27-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB