Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    20-05-2024 10:19

General

  • Target

    e6e85280c32c67b3cbf2173a45634660_NeikiAnalytics.exe

  • Size

    35KB

  • MD5

    e6e85280c32c67b3cbf2173a45634660

  • SHA1

    fa08ceda7b30e98146c1a19d74d3daf8d82af136

  • SHA256

    0a414484d848703889fb77fbbcb497e5fb9743425bd2dce94abe5f307a8353a1

  • SHA512

    dc9a0e6f9548d240e06928d2489698de0237fa4d2238154f29f6fbf04c84c1fa0a7b9feb089e8c68b3dc75b76e8edb5017a8e68195b6c93e1ceb87e3cfd52640

  • SSDEEP

    768:L6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:28Z0kA7FHlO2OwOTUtKjpB

Score
10/10

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e6e85280c32c67b3cbf2173a45634660_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\e6e85280c32c67b3cbf2173a45634660_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2992
      • C:\Windows\SysWOW64\omsecor.exe
        C:\Windows\System32\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1940
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          PID:1332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    35KB

    MD5

    fc3305325edc48a10117306a641e60ab

    SHA1

    4f56f79c51734219bb461291575952716bd33f77

    SHA256

    d85596cec26409a0004e48bc87be2ec1a71f6cfcf5c256ecbd30a57651317eb7

    SHA512

    56b4f7ba5008a456fd92720afe332f0d557433248f2844f907a22b1672d998967a7dd7ca1a6f76a651a32f32f5bb684d6c7005092a2c85dd095bc3866c30aea0

  • \Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    35KB

    MD5

    07fdbbbd4d926e08644248958682c718

    SHA1

    dd04b05687f739af49b4c3f2feb88a1bd2a38642

    SHA256

    a79eb03db3da8357f1186b1fd5774db3bfcaf6eeb71b8d7b3964ed83cac0448d

    SHA512

    d7c4cc8a4a498f2e99e544ea24987e605f54b11039edaeabeac5d2899372535707a9431382ccf6fe49ba885a00c0a41cfe586f415a31f73158e3a2a4e0d3cc69

  • \Windows\SysWOW64\omsecor.exe

    Filesize

    35KB

    MD5

    9dde4e5660df3407b83e5e2f72400c3e

    SHA1

    37ea169ff83df3305eab9679b0c3eafe8931c5d5

    SHA256

    be35cd3d16d0d206b498feec31fab2a49dbfafc66f908796dabf96aa23a6a411

    SHA512

    9f3b809ecc0258a22987d8383ec7a40cfc92b9a6905c917c8e7c6c5a5780980a6269c8cb2ba227c0c926d2d9d8ac72a38c27d7513a3926848db0d5418cd868ba

  • memory/1332-53-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/1332-50-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/1332-48-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/1940-45-0x00000000003B0000-0x00000000003DD000-memory.dmp

    Filesize

    180KB

  • memory/1940-47-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2232-12-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2232-10-0x0000000000220000-0x000000000024D000-memory.dmp

    Filesize

    180KB

  • memory/2232-8-0x0000000000220000-0x000000000024D000-memory.dmp

    Filesize

    180KB

  • memory/2232-0-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2992-21-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2992-34-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2992-27-0x0000000002550000-0x000000000257D000-memory.dmp

    Filesize

    180KB

  • memory/2992-24-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2992-18-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2992-15-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2992-14-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB