Analysis Overview
SHA256
fb84b0f63e1a358e8b0d763ed9da8a8f8d0c2f8704d6721e9cfe2a519b5669be
Threat Level: Known bad
The file a6ec76bf6a43dba184db64eb1953fbf0_NeikiAnalytics.exe was found to be: Known bad.
Malicious Activity Summary
Neconyd family
Neconyd
Executes dropped EXE
Loads dropped DLL
Drops file in System32 directory
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-05-22 20:14
Signatures
Neconyd family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-22 20:14
Reported
2024-05-22 20:17
Platform
win7-20240508-en
Max time kernel
146s
Max time network
150s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a6ec76bf6a43dba184db64eb1953fbf0_NeikiAnalytics.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a6ec76bf6a43dba184db64eb1953fbf0_NeikiAnalytics.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\a6ec76bf6a43dba184db64eb1953fbf0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a6ec76bf6a43dba184db64eb1953fbf0_NeikiAnalytics.exe"
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | mkkuei4kdsz.com | udp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
| US | 8.8.8.8:53 | ow5dirasuek.com | udp |
| US | 35.91.124.102:80 | ow5dirasuek.com | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
Files
\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 454189b0b4e22bffc14853278946ad39 |
| SHA1 | 64feea736e3aadb0188ddc958527ac95cfa2eb1c |
| SHA256 | a65b9663772cdddb64aad2af10c1da4c9c87ea4c0f15ba838eb4665f5934b8e1 |
| SHA512 | ec242a9ffcace6b40bb65770960d3ff8ca90035f86fd943da83e3bb8a7e7b8a5f3f9cdec4b2e17d1dc3f6b7a1259e256a48b31b9914d077bf3b9d43b5c2d3016 |
\Windows\SysWOW64\omsecor.exe
| MD5 | b92b2579e070190ec1f150926ac0147b |
| SHA1 | f2d54fbc465b1da95d1973e1db657c1ded6d3a7a |
| SHA256 | a8e50efcf5487f75679c5db6ea00bdb3164a4cd82c3af930d127ef0dbc9e2507 |
| SHA512 | 3dd89134a3d4e53e34d1e6e792edb3901b4cec8ad8a686db0fbbaa0b12c2fdae38ca66d4d7800dea3fe2c0ad820607cb23c3e2a6a9dfce3d5da08dddbf528444 |
\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 9059f8922c519315488952bdf37b0256 |
| SHA1 | c7f4d56120b9d33e8ae7196c2e48960dd1339749 |
| SHA256 | 21456dcf1ad571a1f4c7f07bc730e1678b1553b4c0de7a1b8941229f52c8dd4b |
| SHA512 | 5a5d2ead6510ba41da60f0df815a246f75ec3334ce5b84a9cf35723c21b9f664aa2af4ebcdd16e03be724c9f8126db9ec057f562da530881b1fe9ff3a4fe53a5 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-22 20:14
Reported
2024-05-22 20:17
Platform
win10v2004-20240426-en
Max time kernel
148s
Max time network
152s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\merocz.xc6 | C:\Windows\SysWOW64\omsecor.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1852 wrote to memory of 1060 | N/A | C:\Users\Admin\AppData\Local\Temp\a6ec76bf6a43dba184db64eb1953fbf0_NeikiAnalytics.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
| PID 1852 wrote to memory of 1060 | N/A | C:\Users\Admin\AppData\Local\Temp\a6ec76bf6a43dba184db64eb1953fbf0_NeikiAnalytics.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
| PID 1852 wrote to memory of 1060 | N/A | C:\Users\Admin\AppData\Local\Temp\a6ec76bf6a43dba184db64eb1953fbf0_NeikiAnalytics.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
| PID 1060 wrote to memory of 1748 | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | C:\Windows\SysWOW64\omsecor.exe |
| PID 1060 wrote to memory of 1748 | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | C:\Windows\SysWOW64\omsecor.exe |
| PID 1060 wrote to memory of 1748 | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | C:\Windows\SysWOW64\omsecor.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\a6ec76bf6a43dba184db64eb1953fbf0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a6ec76bf6a43dba184db64eb1953fbf0_NeikiAnalytics.exe"
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lousta.net | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| NL | 23.62.61.121:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 121.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| NL | 23.62.61.121:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | mkkuei4kdsz.com | udp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.91.225.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ow5dirasuek.com | udp |
| US | 52.111.227.11:443 | tcp | |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 34.197.79.40.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 454189b0b4e22bffc14853278946ad39 |
| SHA1 | 64feea736e3aadb0188ddc958527ac95cfa2eb1c |
| SHA256 | a65b9663772cdddb64aad2af10c1da4c9c87ea4c0f15ba838eb4665f5934b8e1 |
| SHA512 | ec242a9ffcace6b40bb65770960d3ff8ca90035f86fd943da83e3bb8a7e7b8a5f3f9cdec4b2e17d1dc3f6b7a1259e256a48b31b9914d077bf3b9d43b5c2d3016 |
C:\Windows\SysWOW64\omsecor.exe
| MD5 | 81480af3d1998c1cf204240ed3e7ba77 |
| SHA1 | 8e328eb1f028412bfc28a2f789f074dc6650bdd6 |
| SHA256 | e7e174d102fccf9a2c58d8e0b6d5f1ea58e9698281a058489698d6ff6af75b91 |
| SHA512 | 6190d19f43fde89131d737fc5719736cee2235fc077164c15cb4c299eca9a6101bda3edb646f4c32302c12c7d7ede23ba12ea0668c2a851e84bbcb53552cd143 |