Malware Analysis Report

2024-09-11 08:37

Sample ID 240608-ty1xpaeb73
Target fc2ce532ae9436bf0f305d4d0c41bc60_NeikiAnalytics.exe
SHA256 9b6f702db206f4395495e3cf969ff7fa7af7b886ef6691c6e80409e0f46c21df
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9b6f702db206f4395495e3cf969ff7fa7af7b886ef6691c6e80409e0f46c21df

Threat Level: Known bad

The file fc2ce532ae9436bf0f305d4d0c41bc60_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Neconyd family

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-08 16:28

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-08 16:28

Reported

2024-06-08 16:31

Platform

win7-20231129-en

Max time kernel

145s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fc2ce532ae9436bf0f305d4d0c41bc60_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fc2ce532ae9436bf0f305d4d0c41bc60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fc2ce532ae9436bf0f305d4d0c41bc60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2212 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\fc2ce532ae9436bf0f305d4d0c41bc60_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2212 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\fc2ce532ae9436bf0f305d4d0c41bc60_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2212 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\fc2ce532ae9436bf0f305d4d0c41bc60_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2212 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\fc2ce532ae9436bf0f305d4d0c41bc60_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2316 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2316 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2316 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2316 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1716 wrote to memory of 1576 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1716 wrote to memory of 1576 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1716 wrote to memory of 1576 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1716 wrote to memory of 1576 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fc2ce532ae9436bf0f305d4d0c41bc60_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\fc2ce532ae9436bf0f305d4d0c41bc60_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 0fc35d1599ef87b37f411b29fa3bb82c
SHA1 b7cf94b42c08fcf0e1726b2c3d69c95fdc6d7c98
SHA256 db1c449be4a861b061845a15d448841d2348f32ba61e430043b60a762a2569a7
SHA512 b571f5f21b2d8babd2ab1b322ee9412847955c2f013b6b530d3c5c8accf766904695f537bc828d55cfdead7b3e1577b0b8f2fc974d67f3b5c3ae2c90eb5a4d1f

\Windows\SysWOW64\omsecor.exe

MD5 6bb5a6d7359147671f95fc1670177909
SHA1 b05efa7a5020c2263225451140de2e84800e6543
SHA256 9058c43f3160dc853384c19f471d17e3cc3c50ed24d197e1a4a6d4dcdad97878
SHA512 e74105bf760eef9389d1ce5654e9e35270acf45102b616a36fb471bd7325122ba5609431be7c73a3acdef418009cb7ecbcaf5d1f6d75620b5b99103b19f78cdf

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 12b2ebeb8deffa6d1d60bf961127d3b1
SHA1 648d006f71b183eb64a2973ef7dcb9a76fce55f8
SHA256 10253e4ff994190fe2d02689875e4b7a96eae17da303e86686ed364020c29096
SHA512 4c5ea277e539021042fea7e1e4db80643067523efe03100fc92af30f1e06be2cd5488e0e7a62cb16de77e0efebae509d75fb357b362020b83e14779283241cb6

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-08 16:28

Reported

2024-06-08 16:31

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fc2ce532ae9436bf0f305d4d0c41bc60_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
File opened for modification C:\Windows\SysWOW64\merocz.xc6 C:\Windows\SysWOW64\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 552 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\fc2ce532ae9436bf0f305d4d0c41bc60_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 552 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\fc2ce532ae9436bf0f305d4d0c41bc60_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 552 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\fc2ce532ae9436bf0f305d4d0c41bc60_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 748 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 748 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 748 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fc2ce532ae9436bf0f305d4d0c41bc60_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\fc2ce532ae9436bf0f305d4d0c41bc60_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 72.239.69.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 0fc35d1599ef87b37f411b29fa3bb82c
SHA1 b7cf94b42c08fcf0e1726b2c3d69c95fdc6d7c98
SHA256 db1c449be4a861b061845a15d448841d2348f32ba61e430043b60a762a2569a7
SHA512 b571f5f21b2d8babd2ab1b322ee9412847955c2f013b6b530d3c5c8accf766904695f537bc828d55cfdead7b3e1577b0b8f2fc974d67f3b5c3ae2c90eb5a4d1f

C:\Windows\SysWOW64\omsecor.exe

MD5 11bc359d1cd3ccb9f8d6de39f5f28282
SHA1 f56ff963580c3197c5c113438e9698088ca0fa38
SHA256 4e3cacdc3b4287f263924a05f2fb19b5f0c98686824a2a050ab9026a1ea93d6c
SHA512 43827b520930abdcc69875855a192df4b337eea5697a31a8037b39cfc0b67cb8c75cdda565022a1249cd08d24a214984d4b93d18150b51e475f55f2d2da6df00