Malware Analysis Report

2024-09-11 08:36

Sample ID 240608-wjcbwsea7v
Target ba51236c8275381184f6b5ce9d12b2a0_NeikiAnalytics.exe
SHA256 0c70d62cd2654a43658996256837348398a069b8659cf948c61d35e6fb528ac1
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0c70d62cd2654a43658996256837348398a069b8659cf948c61d35e6fb528ac1

Threat Level: Known bad

The file ba51236c8275381184f6b5ce9d12b2a0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-08 17:56

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-08 17:56

Reported

2024-06-08 17:59

Platform

win7-20240221-en

Max time kernel

145s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ba51236c8275381184f6b5ce9d12b2a0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba51236c8275381184f6b5ce9d12b2a0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba51236c8275381184f6b5ce9d12b2a0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2992 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\ba51236c8275381184f6b5ce9d12b2a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2992 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\ba51236c8275381184f6b5ce9d12b2a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2992 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\ba51236c8275381184f6b5ce9d12b2a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2992 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\ba51236c8275381184f6b5ce9d12b2a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 868 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 868 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 868 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 868 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1236 wrote to memory of 1632 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1236 wrote to memory of 1632 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1236 wrote to memory of 1632 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1236 wrote to memory of 1632 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ba51236c8275381184f6b5ce9d12b2a0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\ba51236c8275381184f6b5ce9d12b2a0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 268ff048ffbf43ca4a3d41bb3717fce5
SHA1 3c727af3d87e53e9ac24928f72efa037af0422cc
SHA256 5cfcf4448082759856c25156dc96c9499e7cdefecc03f63da74fc7a69d1afdbb
SHA512 4ecbc3296c4c8e43af27657e81ed04b9962d1063d236aa3f4be6714a6f651badf87fb6f2aeefe6cbca330b7d5f4a830d2f83a93cded4c1aaa9b4512a64e7d91c

\Windows\SysWOW64\omsecor.exe

MD5 09cc9d9860dd132ebd2a44ef0a1fa6d2
SHA1 5eda9d70c7ed75a1acc847be9b8ee66d2dc66cde
SHA256 4ad7ca2cd9d36dc5f79be60ea0bdb28bbe21cf9805a2a5d9c36cb82336aa23c2
SHA512 98c63a7eb79cb6f89a31793abc1deeb15b0306416ae9dc1d592885694cc44c9316f6b73426c342be037d78fa026bd863174a93878285d2ab25c4d8d9d405becd

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 6c4ff9c1343d370ebf194d89b8d08ac0
SHA1 0de5d9c0d2dab214aff4164bccef65f5a17ecad1
SHA256 7ecc18f51625c6aeb2dfdf0bb9b9338f3aa5686f1f59835c3de19b7daf270949
SHA512 02ba6c4a5a230ce14e47fb3a4e2a567b81962c8fcd487a947b3d0ed1419d8d0d954bcb4decde89f58c614207f16838a5f10dcfcbdf15f967e24372d5796d521c

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-08 17:56

Reported

2024-06-08 17:59

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ba51236c8275381184f6b5ce9d12b2a0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 6060 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\ba51236c8275381184f6b5ce9d12b2a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 6060 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\ba51236c8275381184f6b5ce9d12b2a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 6060 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\ba51236c8275381184f6b5ce9d12b2a0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4440 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4440 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4440 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2292 wrote to memory of 1920 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2292 wrote to memory of 1920 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2292 wrote to memory of 1920 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ba51236c8275381184f6b5ce9d12b2a0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\ba51236c8275381184f6b5ce9d12b2a0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 268ff048ffbf43ca4a3d41bb3717fce5
SHA1 3c727af3d87e53e9ac24928f72efa037af0422cc
SHA256 5cfcf4448082759856c25156dc96c9499e7cdefecc03f63da74fc7a69d1afdbb
SHA512 4ecbc3296c4c8e43af27657e81ed04b9962d1063d236aa3f4be6714a6f651badf87fb6f2aeefe6cbca330b7d5f4a830d2f83a93cded4c1aaa9b4512a64e7d91c

C:\Windows\SysWOW64\omsecor.exe

MD5 5a18748f822122e15e8ee433248ebf9b
SHA1 6bd824d02505d5102b5c717b157f648c01c9f0ed
SHA256 99139660b2c7286944758e50485b978374926a90e6c023f4c60dc1b075083a69
SHA512 ef124484ab24da8b7436f5cf1f7b9226a56901b7635e649947bd1c63f8bb1ac9a249bfb1e4fd6530540ff2ecbc75eec2795432e33e6ce58aa2f55c4b1ed0a873

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 a178c9addb8cd59d34fcf05f3459aede
SHA1 24eda1fbc4e86b3f726948de363af0e17be384eb
SHA256 dfd6f6d1dd3eb691726d2de4c81b458518c2c744dc8000ed99565949a3c449a1
SHA512 88d37b58ff8617a789ab9139dbcecba6ab3cc6092a7ae0eff7ab3f88d6f618109d6a49fee939f3efb5b73684ecd3e85b54bcae61be37def05da4a099c36b3dc2