Malware Analysis Report

2024-09-11 08:18

Sample ID 240612-2vvkhaxfql
Target 4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe
SHA256 0e04700c509236e50aff1db22bdf013d21435e0480df5a3a0e3ec3ccf9fc09cd
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0e04700c509236e50aff1db22bdf013d21435e0480df5a3a0e3ec3ccf9fc09cd

Threat Level: Known bad

The file 4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-12 22:54

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 22:54

Reported

2024-06-12 22:57

Platform

win7-20240611-en

Max time kernel

145s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2020 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2020 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2020 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2020 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1732 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1732 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1732 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1732 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2068 wrote to memory of 2756 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2068 wrote to memory of 2756 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2068 wrote to memory of 2756 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2068 wrote to memory of 2756 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 7a19f1e7fb3ba1f8e0bf8d1523c52fa6
SHA1 feac2d591f987806cfd136b8fbb54c0f9958a53e
SHA256 8bfb75662670683792d7e4c481923ecc693125e68b95ba3f368bfcc5367c2b10
SHA512 ba87a28cd04dc5e5edea46a42aa289d14b101f2b586849b6e26bbeeb17339f454ddd0692e811a932afc416f36fa75810fd7b2e7e596f540888882b972b4c3774

\Windows\SysWOW64\omsecor.exe

MD5 a4fb437efabbf1b3c03b9939b26528c8
SHA1 0539436a7041cef80a630e663b30b17007467255
SHA256 b1cee357075b3a67f2ae15c6d29350406c83d3697b0786e798de959edff4b196
SHA512 9acdb7d51d1011b87e78bf1424761efc20b63731cd8e214d6dc3f3dce7075475d05f0837291544a62522ef1ccdefa6549210b61c3f492ede8c5b6bfd6c60f1f6

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 bc29c6994118ce98dd652b9ce6c5e04c
SHA1 a4a3328c5556a93c1372a3fb0b82dc73cbee5882
SHA256 5b4a964aed6d5633d6f5fd839a66ea57ccfa101c5e41370fa3572523a67e95a0
SHA512 fd7c8c41fc0bdadc703f50c6d283f6a28d3146b5a1ea3263ba1bbc891d0d7eda18ef318224fd0f762b606c1de3ab9ec047df609d80e40dc0f691ec7835315262

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 22:54

Reported

2024-06-12 22:57

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2264 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2264 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2264 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3360 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3360 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3360 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2244 wrote to memory of 996 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2244 wrote to memory of 996 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2244 wrote to memory of 996 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
BE 2.17.107.98:443 www.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 98.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 9.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 7a19f1e7fb3ba1f8e0bf8d1523c52fa6
SHA1 feac2d591f987806cfd136b8fbb54c0f9958a53e
SHA256 8bfb75662670683792d7e4c481923ecc693125e68b95ba3f368bfcc5367c2b10
SHA512 ba87a28cd04dc5e5edea46a42aa289d14b101f2b586849b6e26bbeeb17339f454ddd0692e811a932afc416f36fa75810fd7b2e7e596f540888882b972b4c3774

C:\Windows\SysWOW64\omsecor.exe

MD5 d1d044b9ee00ebdb59ede78a9b567994
SHA1 0948b795102d631549b6fa12f590373ae438a37f
SHA256 f1442e0533d1123fa0319238af55ec44259dabc2fc1bb967c77d478cd8fedcb4
SHA512 8e5839c1eec55c8f0da0be385deba36dae09267e3f0e96e06bdab4171765d9979cf69200e1b7c75164201bdde92b500d1cdba0ffe709f0645a62208dfca1d827

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 ecf9ab9b3a9913c82357abed3e739b0e
SHA1 9aa844cb9c2680590148fd57a00d76d02dc6c58b
SHA256 80f4d7574d693ad003ccafcc2a77cfb4919b56ee02042eb9e2161acbe93d0206
SHA512 85d13cec01f3d9a1642fec200199a9cdae3b0a22072fbe3adf4dce540ed67cc4f840a57d947fe04ce6eaf8a48f50275d0fff9d299a55eccdc9ffa81ea51f1b69