Malware Analysis Report

2024-09-11 08:39

Sample ID 240611-mb8kpaterm
Target 317a863bc714456a17cc3504ced59830_NeikiAnalytics.exe
SHA256 a0c8998891b3ae3e35e70dd0ebb8f9ec48d5714c868b75f66eccf574f201f6a4
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a0c8998891b3ae3e35e70dd0ebb8f9ec48d5714c868b75f66eccf574f201f6a4

Threat Level: Known bad

The file 317a863bc714456a17cc3504ced59830_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-11 10:18

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 10:18

Reported

2024-06-11 10:21

Platform

win7-20240220-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\317a863bc714456a17cc3504ced59830_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\317a863bc714456a17cc3504ced59830_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\317a863bc714456a17cc3504ced59830_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2252 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\317a863bc714456a17cc3504ced59830_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2252 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\317a863bc714456a17cc3504ced59830_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2252 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\317a863bc714456a17cc3504ced59830_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2252 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\317a863bc714456a17cc3504ced59830_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2688 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2688 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2688 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2688 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1944 wrote to memory of 1668 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1944 wrote to memory of 1668 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1944 wrote to memory of 1668 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1944 wrote to memory of 1668 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\317a863bc714456a17cc3504ced59830_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\317a863bc714456a17cc3504ced59830_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 c2f0136cd976b4a5ab05da4ba002d1b8
SHA1 db67fafdf9f5bba343d91d1c2b4e1b352ea90bff
SHA256 c8ddc1ad834ce76f07a8414d4a75c3a2e92234153160c53a49aed0a1e2765848
SHA512 0eb5819e5b04dbfbcc2690b4103f544b1618666600a2ec49de21db571d7639116528fa93f78c0d092f516130e30191f023204d30cb05b5ef3827336f2d381162

\Windows\SysWOW64\omsecor.exe

MD5 7d539a4427a6f180bd2e3bb3c98d5447
SHA1 351076950c0e4a935d637788c6c5e9e4f9e3c73a
SHA256 9fd48c6b145c7b693a1b8874d38e19352ae51644cf59dcb357e5aa8142e7fb3f
SHA512 c0bcfe951975aa9cea2e7c0e0895b2482d7fc252a78fd5400ca0111ceb8f45e8dac8cd8993bd5b2a69dcaa0679389db18bf9afcaa7501ca2b490a6d671ca898b

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 6b33aeb7910fc8952e3cec1b07c54cf2
SHA1 85b7f200c29a3edf45b01e9333a627f729b00274
SHA256 80c2800aeb91942aecd30145cb79afea0a055461102e9a9b95a59c8b572838c0
SHA512 95317014838917df905e496cb86e8c688fc640523e1efe2f638a3b361d4a9ce70019b9bf375e2c583a202f80008ed7d3c57f32cfab0c82ec40c56bd081d901d3

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 10:18

Reported

2024-06-11 10:21

Platform

win10v2004-20240226-en

Max time kernel

131s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\317a863bc714456a17cc3504ced59830_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
File opened for modification C:\Windows\SysWOW64\merocz.xc6 C:\Windows\SysWOW64\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2296 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\317a863bc714456a17cc3504ced59830_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2296 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\317a863bc714456a17cc3504ced59830_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2296 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\317a863bc714456a17cc3504ced59830_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2064 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2064 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2064 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\317a863bc714456a17cc3504ced59830_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\317a863bc714456a17cc3504ced59830_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
GB 216.58.201.106:443 tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 138.107.17.2.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 c2f0136cd976b4a5ab05da4ba002d1b8
SHA1 db67fafdf9f5bba343d91d1c2b4e1b352ea90bff
SHA256 c8ddc1ad834ce76f07a8414d4a75c3a2e92234153160c53a49aed0a1e2765848
SHA512 0eb5819e5b04dbfbcc2690b4103f544b1618666600a2ec49de21db571d7639116528fa93f78c0d092f516130e30191f023204d30cb05b5ef3827336f2d381162

C:\Windows\SysWOW64\omsecor.exe

MD5 2e38fd64fdfcdb922baaf546a64151d9
SHA1 bd4e0ae32fde2c6b94d1b475d63be59fd97ac4d3
SHA256 4cac92cba08a524d6794e32c74122da72fd71d6589dc1dbd5c7f01e25883487a
SHA512 3c93e833a8aa31ec49f5ef020df00b35eeb2f277f229d8829badfea64794be8f30f9ea5d139a6bd607a11bc7ff8d0d1573f89362f5b88ec5f0c4ac7d5be4d7d1