Analysis Overview
SHA256
ca301a6619899cb9bbd86ce847b3c4cd72607e2cfb92eea7f112302df11cb081
Threat Level: Known bad
The file a4c51793929b7aa929e71d2bc475d3f0_NeikiAnalytics.exe was found to be: Known bad.
Malicious Activity Summary
Neconyd
Neconyd family
Executes dropped EXE
Loads dropped DLL
Drops file in System32 directory
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-05-24 04:16
Signatures
Neconyd family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-24 04:16
Reported
2024-05-24 04:18
Platform
win7-20240221-en
Max time kernel
146s
Max time network
152s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a4c51793929b7aa929e71d2bc475d3f0_NeikiAnalytics.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a4c51793929b7aa929e71d2bc475d3f0_NeikiAnalytics.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\a4c51793929b7aa929e71d2bc475d3f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a4c51793929b7aa929e71d2bc475d3f0_NeikiAnalytics.exe"
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | mkkuei4kdsz.com | udp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
| US | 8.8.8.8:53 | ow5dirasuek.com | udp |
| US | 52.34.198.229:80 | ow5dirasuek.com | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
Files
C:\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | f7f1b99d112811a3953422baf891c0e8 |
| SHA1 | 2294f6cc08baa26790d14fe2f52a82ee9ccd39ee |
| SHA256 | a15c63366c76e409826e8eed3597eeb582a2265aef8c42195c434306a8bfe7ba |
| SHA512 | 157668cdc8cf247e8b55a39cd29c227bb8f9e9785d32cd836258a98fa861e1d383e710873d91cc9d5a2751bf9a66e1884558d0eb04a616d9e02374b0a2923f2b |
\Windows\SysWOW64\omsecor.exe
| MD5 | 5bd96f7496abf3fbba7828eaccbca762 |
| SHA1 | 5a6677df704c8c35cb0aabafd74cdcf5f2255330 |
| SHA256 | 64744716682f8812855c5408f8076a66dc8615da47fe2c8e7b55cc76d1a530ef |
| SHA512 | 3c00f2f166923487de14134c6f2bc6b1f3eb148f8a0e36895dba259d56584e0610acb053a476fffb74e2a783baa4d2aa0362437210977672062ac0c77fde4907 |
\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 61e6683a04700894ba693726e717d505 |
| SHA1 | f20325fce48c0b81a1c3810f72a2aa9649b4f3d3 |
| SHA256 | ec545fd7f57ad351eb8de263b3d3f444403c5422e1770ae2226b3be60573fcbf |
| SHA512 | b98889526b870c35d11245e1179c6c6954563ebc2b67be760d4a3532cc78970f86d50d1f95f966dadde1578062f3ef130e7fcb9dfc0a49b6bebc715ade0a6125 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-24 04:16
Reported
2024-05-24 04:18
Platform
win10v2004-20240226-en
Max time kernel
143s
Max time network
148s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\merocz.xc6 | C:\Windows\SysWOW64\omsecor.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2388 wrote to memory of 3180 | N/A | C:\Users\Admin\AppData\Local\Temp\a4c51793929b7aa929e71d2bc475d3f0_NeikiAnalytics.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
| PID 2388 wrote to memory of 3180 | N/A | C:\Users\Admin\AppData\Local\Temp\a4c51793929b7aa929e71d2bc475d3f0_NeikiAnalytics.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
| PID 2388 wrote to memory of 3180 | N/A | C:\Users\Admin\AppData\Local\Temp\a4c51793929b7aa929e71d2bc475d3f0_NeikiAnalytics.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
| PID 3180 wrote to memory of 324 | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | C:\Windows\SysWOW64\omsecor.exe |
| PID 3180 wrote to memory of 324 | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | C:\Windows\SysWOW64\omsecor.exe |
| PID 3180 wrote to memory of 324 | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | C:\Windows\SysWOW64\omsecor.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\a4c51793929b7aa929e71d2bc475d3f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a4c51793929b7aa929e71d2bc475d3f0_NeikiAnalytics.exe"
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| GB | 142.250.179.234:443 | chromewebstore.googleapis.com | tcp |
| US | 8.8.8.8:53 | 234.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | mkkuei4kdsz.com | udp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
| US | 8.8.8.8:53 | 18.24.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.91.225.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ow5dirasuek.com | udp |
| US | 52.34.198.229:80 | ow5dirasuek.com | tcp |
| US | 8.8.8.8:53 | 229.198.34.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 84.65.42.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | f7f1b99d112811a3953422baf891c0e8 |
| SHA1 | 2294f6cc08baa26790d14fe2f52a82ee9ccd39ee |
| SHA256 | a15c63366c76e409826e8eed3597eeb582a2265aef8c42195c434306a8bfe7ba |
| SHA512 | 157668cdc8cf247e8b55a39cd29c227bb8f9e9785d32cd836258a98fa861e1d383e710873d91cc9d5a2751bf9a66e1884558d0eb04a616d9e02374b0a2923f2b |
C:\Windows\SysWOW64\omsecor.exe
| MD5 | 22ec0540ca6e39e5f8ade6b32e8b7180 |
| SHA1 | 287b352e3fab4e0e19502a113d866709ccf322a2 |
| SHA256 | 4656e8e7d0a24de7f7ffe349d9c1e3b1c7a678705e9fde4ff1f66777f1b26e62 |
| SHA512 | 61a1315005d8bdacaf30f2ce8804e9be918f393dc3ef4bd52f10beecba000af70885fdd3b5fa359545a74da5b7a5e11ee8ac4edb55ec446444eca2a809105bca |