Analysis Overview
SHA256
d55f838809aff14c14a807c5a6620134ef17dc4c7091af6b5095722a16408961
Threat Level: Known bad
The file 25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe was found to be: Known bad.
Malicious Activity Summary
Neconyd
Executes dropped EXE
Loads dropped DLL
Drops file in System32 directory
Suspicious use of SetThreadContext
Program crash
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-05-24 06:08
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-24 06:08
Reported
2024-05-24 06:11
Platform
win10v2004-20240508-en
Max time kernel
146s
Max time network
149s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1120 set thread context of 2128 | N/A | C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe | C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe |
| PID 3512 set thread context of 4828 | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
| PID 4072 set thread context of 1288 | N/A | C:\Windows\SysWOW64\omsecor.exe | C:\Windows\SysWOW64\omsecor.exe |
| PID 1444 set thread context of 2944 | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
Program crash
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe"
C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1120 -ip 1120
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 288
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3512 -ip 3512
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 300
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4048,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4072 -ip 4072
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 292
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1444 -ip 1444
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 256
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | mkkuei4kdsz.com | udp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
| US | 8.8.8.8:53 | 73.91.225.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ow5dirasuek.com | udp |
| US | 52.34.198.229:80 | ow5dirasuek.com | tcp |
| US | 8.8.8.8:53 | 229.198.34.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.73.42.20.in-addr.arpa | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
Files
memory/1120-0-0x0000000000400000-0x0000000000423000-memory.dmp
memory/2128-1-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2128-2-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2128-3-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2128-7-0x0000000000400000-0x0000000000429000-memory.dmp
C:\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 347e4d792dee83cfd14d5394577dfe8a |
| SHA1 | 7a2994120140b0daccce2084a942461579d54f77 |
| SHA256 | ca1c24d63efff269d82a4277ca4147f6efa2a53847213477c537e350a146f828 |
| SHA512 | 5d9b0588f25469b4af9fde6192f1fdb72b5146774ec3e28ce65cf5aed3096983ff926fd59fa7c9a0da06d8af0a5bc0bc1b5ffe578de8fc72ba0b1964818660c5 |
memory/3512-11-0x0000000000400000-0x0000000000423000-memory.dmp
memory/4828-14-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4828-15-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3512-17-0x0000000000400000-0x0000000000423000-memory.dmp
memory/4828-19-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4828-22-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4828-25-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4828-26-0x0000000000400000-0x0000000000429000-memory.dmp
C:\Windows\SysWOW64\omsecor.exe
| MD5 | 1638a3ab1e706a060000027093f51f3e |
| SHA1 | 9d29f0c62506cdf848eaeb01c8589d13ccc2e0b1 |
| SHA256 | 919fcb63eeb7d01b9a72338d3c7cdcce67e2116347fe9e0a1084db0ef68b18a7 |
| SHA512 | dfca24d01a6cc7c53f5513f4acbb861c77db9f1b0c724290fd6305d9fbfd5b516693cc7917840a1d1bd18b6ad77392c0892c492a47f1b11f9440d4cbc70c5a92 |
memory/4828-32-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4072-34-0x0000000000400000-0x0000000000423000-memory.dmp
memory/1288-38-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1288-40-0x0000000000400000-0x0000000000429000-memory.dmp
C:\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | fe8d9fb1e95d914a414eb8549a5e5c7e |
| SHA1 | 32d7c651e322b62c6c786454f44b0f0f1d3a6dce |
| SHA256 | 9b9c46668b3ef62316bf11326beaba9c53636478dc928232a2b1b00b2d53b86c |
| SHA512 | 10d928cd99d47efe4afa1f4289d7cfb89cc5efa8ff01c0b9a9c8893d0c5c0638487b7e2d027ad156001ce2758863b9a8333f03f271a48b4b6921082fa8c49d58 |
memory/1288-37-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1444-44-0x0000000000400000-0x0000000000423000-memory.dmp
memory/2944-50-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2944-49-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4072-52-0x0000000000400000-0x0000000000423000-memory.dmp
memory/1444-54-0x0000000000400000-0x0000000000423000-memory.dmp
memory/2944-55-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2944-58-0x0000000000400000-0x0000000000429000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-24 06:08
Reported
2024-05-24 06:11
Platform
win7-20240221-en
Max time kernel
146s
Max time network
150s
Command Line
Signatures
Neconyd
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\omsecor.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2916 set thread context of 2948 | N/A | C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe | C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe |
| PID 2076 set thread context of 2588 | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
| PID 2268 set thread context of 688 | N/A | C:\Windows\SysWOW64\omsecor.exe | C:\Windows\SysWOW64\omsecor.exe |
| PID 2032 set thread context of 2800 | N/A | C:\Users\Admin\AppData\Roaming\omsecor.exe | C:\Users\Admin\AppData\Roaming\omsecor.exe |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe"
C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
C:\Users\Admin\AppData\Local\Temp\25dd9eba7a6bc6db29f90a21094acd70_NeikiAnalytics.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Windows\SysWOW64\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 8.8.8.8:53 | mkkuei4kdsz.com | udp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
| US | 8.8.8.8:53 | ow5dirasuek.com | udp |
| US | 52.34.198.229:80 | ow5dirasuek.com | tcp |
| US | 8.8.8.8:53 | lousta.net | udp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| FI | 193.166.255.171:80 | lousta.net | tcp |
| US | 64.225.91.73:80 | mkkuei4kdsz.com | tcp |
Files
memory/2076-33-0x0000000000400000-0x0000000000423000-memory.dmp
C:\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | 347e4d792dee83cfd14d5394577dfe8a |
| SHA1 | 7a2994120140b0daccce2084a942461579d54f77 |
| SHA256 | ca1c24d63efff269d82a4277ca4147f6efa2a53847213477c537e350a146f828 |
| SHA512 | 5d9b0588f25469b4af9fde6192f1fdb72b5146774ec3e28ce65cf5aed3096983ff926fd59fa7c9a0da06d8af0a5bc0bc1b5ffe578de8fc72ba0b1964818660c5 |
memory/2076-23-0x0000000000400000-0x0000000000423000-memory.dmp
memory/2948-15-0x0000000000230000-0x0000000000253000-memory.dmp
memory/2916-12-0x0000000000400000-0x0000000000423000-memory.dmp
memory/2948-11-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2916-10-0x0000000000260000-0x0000000000283000-memory.dmp
memory/2948-8-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2948-5-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2948-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2948-1-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2916-0-0x0000000000400000-0x0000000000423000-memory.dmp
memory/2588-36-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2588-39-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2588-42-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2588-45-0x0000000000400000-0x0000000000429000-memory.dmp
\Windows\SysWOW64\omsecor.exe
| MD5 | bc3409e79fe026516be95bb1c3e17d39 |
| SHA1 | 4c428257e481482ae6ba7744c2f3bb21879df763 |
| SHA256 | d192b55f54cf6b2f42ba1452255349721314d642e2130b7522e6e19188c0d514 |
| SHA512 | a16d49b166038a1a19aa1b6aaf74ab98af912431112c161168644d2d9b912ee3858d89b7793a53dec5faa1abd6c6e03b34a6acdb876579c21ddc8ae22443e7d8 |
memory/2588-48-0x0000000000290000-0x00000000002B3000-memory.dmp
memory/2588-56-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2268-58-0x0000000000400000-0x0000000000423000-memory.dmp
memory/2268-67-0x0000000000400000-0x0000000000423000-memory.dmp
\Users\Admin\AppData\Roaming\omsecor.exe
| MD5 | d1f92ba093d27549b6683e34cff011f3 |
| SHA1 | b6b4fcf5cf4ee295b9d5498ac15389941c13c3d0 |
| SHA256 | e6c65182352f7bce38798af9de7bf6ef864f7fcdd731f1f4291dd491d95f53c1 |
| SHA512 | 0d28591c534954631a36939373c843765039da57b7ef26063638456b3ae9f08061a55f69cd61f8277eaba46b52b86a7a3b2746eff2a402238584612b664bba34 |
memory/2032-80-0x0000000000400000-0x0000000000423000-memory.dmp
memory/2032-88-0x0000000000400000-0x0000000000423000-memory.dmp
memory/2800-90-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2800-93-0x0000000000400000-0x0000000000429000-memory.dmp