Malware Analysis Report

2024-09-11 08:37

Sample ID 240607-16atssed44
Target 71f0658fb586d3e6c81daac0faf02d30_NeikiAnalytics.exe
SHA256 1f8af6dc294105a4346c258efd75a778026217cc0dbefc8bbbd484c00e7d21e4
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1f8af6dc294105a4346c258efd75a778026217cc0dbefc8bbbd484c00e7d21e4

Threat Level: Known bad

The file 71f0658fb586d3e6c81daac0faf02d30_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-07 22:15

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-07 22:15

Reported

2024-06-07 22:17

Platform

win7-20240221-en

Max time kernel

146s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\71f0658fb586d3e6c81daac0faf02d30_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\71f0658fb586d3e6c81daac0faf02d30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\71f0658fb586d3e6c81daac0faf02d30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1940 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\71f0658fb586d3e6c81daac0faf02d30_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1940 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\71f0658fb586d3e6c81daac0faf02d30_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1940 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\71f0658fb586d3e6c81daac0faf02d30_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1940 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\71f0658fb586d3e6c81daac0faf02d30_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2064 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2064 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2064 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2064 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2788 wrote to memory of 2204 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2788 wrote to memory of 2204 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2788 wrote to memory of 2204 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2788 wrote to memory of 2204 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\71f0658fb586d3e6c81daac0faf02d30_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\71f0658fb586d3e6c81daac0faf02d30_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 7aef4598776cfd36ec8ede00f7665def
SHA1 4e118ebf5e7540f1f2453c2c7f57269eec7065e9
SHA256 c0a52d6878a33b372328fbf46d61bdec4a7ccbf60ff5fb77bf1e8f470444d315
SHA512 fae51c720506b8d9d31fc7e8344799b417e1fb6bfe9dc97df75b6708e080e75e7b092f85c877c8ce72aaec01f7e4b6cb4c75298242de3124d86188f059c71e43

\Windows\SysWOW64\omsecor.exe

MD5 657b2c61808e8d39f3a5a345a75ada20
SHA1 56d67ecb200eae91db716266aff2c68048f53fee
SHA256 f94fbb13b407ef2902c6cf98bff32f54e9407ecd1d649cc22281d71bd9d2b166
SHA512 17d3d90dc79ebed2b7b96e1963889246122eb51963cc832fab497ed04d8203ac7048f0f35a168e87bab975e7d4f469c9c98282d97f584b95c026a1af616966ab

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 8ff1bb33d7829cec7784f9bbb462874d
SHA1 88d0d845ff643d2222151c18c692fbb0e51528e0
SHA256 f29debb29ead2af9eb9ebcf48aa497a7a0df8095f727476936fed91b1009c9d2
SHA512 1f264dd38d886de2fda6e127805ca379c5e6d9efebd2198306b8562896db6d55355b093565e85e21927f4e3c7ca6a886e01168d19a92d99ec4153be70bba62dd

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-07 22:15

Reported

2024-06-07 22:17

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\71f0658fb586d3e6c81daac0faf02d30_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4888 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\71f0658fb586d3e6c81daac0faf02d30_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4888 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\71f0658fb586d3e6c81daac0faf02d30_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4888 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\71f0658fb586d3e6c81daac0faf02d30_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3088 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3088 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3088 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3108 wrote to memory of 4580 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3108 wrote to memory of 4580 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3108 wrote to memory of 4580 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\71f0658fb586d3e6c81daac0faf02d30_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\71f0658fb586d3e6c81daac0faf02d30_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 31.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 7aef4598776cfd36ec8ede00f7665def
SHA1 4e118ebf5e7540f1f2453c2c7f57269eec7065e9
SHA256 c0a52d6878a33b372328fbf46d61bdec4a7ccbf60ff5fb77bf1e8f470444d315
SHA512 fae51c720506b8d9d31fc7e8344799b417e1fb6bfe9dc97df75b6708e080e75e7b092f85c877c8ce72aaec01f7e4b6cb4c75298242de3124d86188f059c71e43

C:\Windows\SysWOW64\omsecor.exe

MD5 191f5a4f81537c0783160b1c07cac249
SHA1 1f39bbebb40ed0e400e120b50f93d09fab24b4e1
SHA256 d128af6f19298d31164b0c8ded0e7677b2f5c74a363dac92d0dc0d36c4dc727e
SHA512 f617c828b13e1465e207331c12e8b030a67f03203883bf7b0e2cf6a398c493c72c95314fefc99854e483b6af47571d3111f3f64cd416b3d28df2f6f4629744ac

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 e34ebfd281d5a2b7bc7955d5ad65c9d1
SHA1 27c452c05f361d6633e717cc21213bf48eb0cb7a
SHA256 aaf9bcfb300f552d8c73e3ed428baa73202bd442fc4a173aa022c7bedcd3ea72
SHA512 18e5a86aa146db24f98383b0085fb60871751138b48c50e1dc18016279a641b0580c4b75028523be2f9363f514e3dc883df970c23fc550296b747bb5307a92bc