Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 15:57
Behavioral task
behavioral1
Sample
eb1e83c18cc7a8366a0fbe64d952bf60_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
eb1e83c18cc7a8366a0fbe64d952bf60_NeikiAnalytics.exe
-
Size
64KB
-
MD5
eb1e83c18cc7a8366a0fbe64d952bf60
-
SHA1
bf32cc86e6145f6b262b09cff5cf234fe1aa87f5
-
SHA256
13473a8ea2c2ef9ff7e052c636da90019ae5dd2c5213f5a98bfd78831f224e87
-
SHA512
d61a75360dcc4ec26ccb677e639eaea70683aaf2afb1f22da1b206937e04edb8eb00536ef8ff60208b7c999581228f427b1cc87bb77a97f52e2f17158efa5e25
-
SSDEEP
768:iMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:ibIvYvZEyFKF6N4yS+AQmZcl/5
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
omsecor.exeomsecor.exeomsecor.exepid process 2188 omsecor.exe 2692 omsecor.exe 1196 omsecor.exe -
Loads dropped DLL 6 IoCs
Processes:
eb1e83c18cc7a8366a0fbe64d952bf60_NeikiAnalytics.exeomsecor.exeomsecor.exepid process 2368 eb1e83c18cc7a8366a0fbe64d952bf60_NeikiAnalytics.exe 2368 eb1e83c18cc7a8366a0fbe64d952bf60_NeikiAnalytics.exe 2188 omsecor.exe 2188 omsecor.exe 2692 omsecor.exe 2692 omsecor.exe -
Drops file in System32 directory 1 IoCs
Processes:
omsecor.exedescription ioc process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
eb1e83c18cc7a8366a0fbe64d952bf60_NeikiAnalytics.exeomsecor.exeomsecor.exedescription pid process target process PID 2368 wrote to memory of 2188 2368 eb1e83c18cc7a8366a0fbe64d952bf60_NeikiAnalytics.exe omsecor.exe PID 2368 wrote to memory of 2188 2368 eb1e83c18cc7a8366a0fbe64d952bf60_NeikiAnalytics.exe omsecor.exe PID 2368 wrote to memory of 2188 2368 eb1e83c18cc7a8366a0fbe64d952bf60_NeikiAnalytics.exe omsecor.exe PID 2368 wrote to memory of 2188 2368 eb1e83c18cc7a8366a0fbe64d952bf60_NeikiAnalytics.exe omsecor.exe PID 2188 wrote to memory of 2692 2188 omsecor.exe omsecor.exe PID 2188 wrote to memory of 2692 2188 omsecor.exe omsecor.exe PID 2188 wrote to memory of 2692 2188 omsecor.exe omsecor.exe PID 2188 wrote to memory of 2692 2188 omsecor.exe omsecor.exe PID 2692 wrote to memory of 1196 2692 omsecor.exe omsecor.exe PID 2692 wrote to memory of 1196 2692 omsecor.exe omsecor.exe PID 2692 wrote to memory of 1196 2692 omsecor.exe omsecor.exe PID 2692 wrote to memory of 1196 2692 omsecor.exe omsecor.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb1e83c18cc7a8366a0fbe64d952bf60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\eb1e83c18cc7a8366a0fbe64d952bf60_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
PID:1196
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD54e5fff3cdec056e923c95d1e4153b595
SHA1bc9a7e659dfc1b7f35b5b441c848773085b21e53
SHA2563154f7eef2e1ddf6471f36894fdb013844d60c9e2f156802d9132de4f7e855a1
SHA51236a1594482aab2d174ccd522ffbc7fc97f461deeb3e4fdc5fbe1ce8e8f2e5490e94a158e8bc73716f9261ca92f115397ebca55c354bddc8e5cf16152e45e3bd7
-
Filesize
64KB
MD5f7115e3a437697be310e20f8829a0a2b
SHA1eb6b45572197e8b2380daf41d953984500082ae3
SHA2562c0f8a651a6c77a0081c09ff2c8138a6077535aa9a9a43b772acfffb33a042f8
SHA51267ff070e02b1a0fd8ffb9076a4be3bb7a438891431fee1abffd18cba13905ba9123c8e31e5f327a498262d56118ecd04b4f97bd8dde61fb5489e0b4294b40838
-
Filesize
64KB
MD517703fe2addd2e12997845ba2a5f016e
SHA1294753dab776cbadfb86ebfaff1fed35335654aa
SHA256e883959249ffce31167dcc92473cd4b3e6a72cfb9015d1bfec43280c8336502b
SHA512350f004509873110c26cc26346484c6742a477cd6d02ec4af15def57dfcd631673cbc034dc10d4b05d2da56849c96ee699b08e7ff3f86260a86b96631f3c39d1