Malware Analysis Report

2024-09-11 08:37

Sample ID 240609-jf8vgaff91
Target 164aff05e7c88293159b810cd7173050_NeikiAnalytics.exe
SHA256 d5d03eee42a3458d42aff1e1c1ad363ddd06cb874b5f0afbcea4976e29eb8d6c
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d5d03eee42a3458d42aff1e1c1ad363ddd06cb874b5f0afbcea4976e29eb8d6c

Threat Level: Known bad

The file 164aff05e7c88293159b810cd7173050_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-09 07:37

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-09 07:37

Reported

2024-06-09 07:40

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\164aff05e7c88293159b810cd7173050_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
File opened for modification C:\Windows\SysWOW64\merocz.xc6 C:\Windows\SysWOW64\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3896 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\164aff05e7c88293159b810cd7173050_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3896 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\164aff05e7c88293159b810cd7173050_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3896 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\164aff05e7c88293159b810cd7173050_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 220 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 220 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 220 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\164aff05e7c88293159b810cd7173050_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\164aff05e7c88293159b810cd7173050_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 afda197ae6d029c05a1b6d509058e24b
SHA1 494a2f3a3eefcf15d9ac6ca6708d234e9c29eab8
SHA256 76b9e0a8e1b66432f385606088bee19e64510f94ee3a50e7e2d4d8ee57dc3c45
SHA512 b642ce8da12e2cdbaccdd0e326665c3b33d6aff24e5caf6980826ca1c461784904f20b3b7877f94eb98aa1d92c507e6134f2fb7fbe2c2a6d52693ba82e17dde4

C:\Windows\SysWOW64\omsecor.exe

MD5 4bbacd8dba8c843557e1292d326bcaa1
SHA1 b3c588daae574b78d28fa18557d708298a5664a9
SHA256 93d519e8494100e98cbe4e83a58255741a8f2e30c709953d6ca42a20d3cbb08d
SHA512 0bd32c505c376d395b2e745ddc8ddfb519ec2d5d6db30b66b95c9a688090fe13ac751402733b9349aebf88a2848862b961fb3552d0cb1137a87cf6bd9b417bd9

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-09 07:37

Reported

2024-06-09 07:40

Platform

win7-20240221-en

Max time kernel

145s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\164aff05e7c88293159b810cd7173050_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\164aff05e7c88293159b810cd7173050_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\164aff05e7c88293159b810cd7173050_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1728 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\164aff05e7c88293159b810cd7173050_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1728 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\164aff05e7c88293159b810cd7173050_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1728 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\164aff05e7c88293159b810cd7173050_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1728 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\164aff05e7c88293159b810cd7173050_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1712 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1712 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1712 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1712 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2860 wrote to memory of 2920 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2860 wrote to memory of 2920 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2860 wrote to memory of 2920 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2860 wrote to memory of 2920 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\164aff05e7c88293159b810cd7173050_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\164aff05e7c88293159b810cd7173050_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 afda197ae6d029c05a1b6d509058e24b
SHA1 494a2f3a3eefcf15d9ac6ca6708d234e9c29eab8
SHA256 76b9e0a8e1b66432f385606088bee19e64510f94ee3a50e7e2d4d8ee57dc3c45
SHA512 b642ce8da12e2cdbaccdd0e326665c3b33d6aff24e5caf6980826ca1c461784904f20b3b7877f94eb98aa1d92c507e6134f2fb7fbe2c2a6d52693ba82e17dde4

\Windows\SysWOW64\omsecor.exe

MD5 e68fff48d30aa5de5962cd1390dab119
SHA1 30fe5a246a374e2e8209103de2fc883d21d855aa
SHA256 8474c63fa5c6038c5056ec9f97075dbae4aa55995b649a9edb2e7ee5372f3591
SHA512 6ebedee8dc4c681cae600872b267cc5f4247070d047dd0e52cccc496d9dd73e159e59a736a22234a5f5191fedd58eab3550386e1e48c8df55e675cf49ccb5e84

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 cba3a9cfa55de4da2be2b14b962a9ce2
SHA1 66b08ee6c71729a7663e84cb1f041f60ebd5e3ed
SHA256 7c5580008f30f0879310e6efbb6943255ebe6debaafbf1c0fde1ec5fbd73b907
SHA512 b502035556ad12a267ce06270de68886aad9593737f9a1064513a52621d6c5d744e91630f59db2401317955092464fd58d0a1766dd1b268b5f4314e6f9454c2c