Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    20-05-2024 07:24

General

  • Target

    d0efb5497c7eebd213ef6ff801d16fa0_NeikiAnalytics.exe

  • Size

    92KB

  • MD5

    d0efb5497c7eebd213ef6ff801d16fa0

  • SHA1

    e148ff316600c1562af98b7d5ba2b81cfb4a1aa0

  • SHA256

    b6855800b7590ffff020758f8debf87cd93fc1eed7524647f2322e8cad9ac2ae

  • SHA512

    8db71ca7e4b11fa5c0aa585d352ceaf38b3c82c11fa732dc8cb0913058696195bb44237f6b2d1da407c13bcfd54944196346176c34f21b2ec4f7c20a24cdf0c4

  • SSDEEP

    768:XMTIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:XUIvYvZEgFKF6N4yS+AQmZTl/5

Score
10/10

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d0efb5497c7eebd213ef6ff801d16fa0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\d0efb5497c7eebd213ef6ff801d16fa0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Windows\SysWOW64\omsecor.exe
        C:\Windows\System32\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2784
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    92KB

    MD5

    9d83235880b393306ce82a8312bcb6d8

    SHA1

    9619b2513fafd662bc267d4e1f9a1385a5e835eb

    SHA256

    995faf9ddc9a560bbdf5c9a8158659424e736093f07f91b2c60d9001e1b01259

    SHA512

    6f600fd6a71325ede580af8d19a9eb321fc4069df58b87a127bd3a9c7338e58f2009223cb5c656505d611a395da4cd65704a82513ca4b13240ea8c170b0f0832

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    92KB

    MD5

    3461ef828525235e423cbe16e827c75e

    SHA1

    3a76a0bc08ecb118f44f6e34d071271b3395b98c

    SHA256

    ddc67cb2ed7b19a3cb4149c499016640494c73a97dc90f5a1efcf6efbee0a3e3

    SHA512

    1bb3b3b478a6b47322f154bc80d73c18ede6b9fd616690ae5753c4ed21e9ac22381d0787bca59f19f60248bdf71c0e6843ce6de39ace576aeef4e8e54ae009f4

  • \Windows\SysWOW64\omsecor.exe

    Filesize

    92KB

    MD5

    db32eababb23dfeac2151d4e3d2b532b

    SHA1

    4c23ccecebb36e8897935c60bd7925fd15df0c74

    SHA256

    296b5fe0cf128174e61e9c49dc036ce0ee18810147aa78eb5afd00dfbe4700a5

    SHA512

    468d2ca9997643057cdc47599d13201c7d691fa0aa2bbef32515734c89d711ebdeb8ddd6972959bb3bde78dc8dac74e4fa0e059e272140f591bb8b5e4d1ab4d5

  • memory/1636-35-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/1636-37-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/2128-0-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/2128-3-0x00000000001B0000-0x00000000001DB000-memory.dmp

    Filesize

    172KB

  • memory/2128-9-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/2328-12-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/2328-17-0x0000000000280000-0x00000000002AB000-memory.dmp

    Filesize

    172KB

  • memory/2328-24-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/2784-33-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB