Malware Analysis Report

2024-09-11 08:40

Sample ID 240612-j8px3awarn
Target 2af1f38945e189655455fe1302bd76f0_NeikiAnalytics.exe
SHA256 f0adc4db804d6edc3d8a1c91f2468ce9a253cabed9cda28828aaa76112a0ed78
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f0adc4db804d6edc3d8a1c91f2468ce9a253cabed9cda28828aaa76112a0ed78

Threat Level: Known bad

The file 2af1f38945e189655455fe1302bd76f0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Neconyd family

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-12 08:20

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 08:20

Reported

2024-06-12 08:23

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2af1f38945e189655455fe1302bd76f0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
File opened for modification C:\Windows\SysWOW64\merocz.xc6 C:\Windows\SysWOW64\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4472 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\2af1f38945e189655455fe1302bd76f0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4472 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\2af1f38945e189655455fe1302bd76f0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4472 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\2af1f38945e189655455fe1302bd76f0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2360 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2360 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2360 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2af1f38945e189655455fe1302bd76f0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2af1f38945e189655455fe1302bd76f0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1712 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 99.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 172.217.169.42:443 chromewebstore.googleapis.com tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 8134ebc571ffdcfecd410e0a271b694c
SHA1 70b382f8f550650276ee143ff51c2ffa9c770ab6
SHA256 36618a470c0e24d6a3064c7967be8cdab13878ee81d886578ae8d2e4b84f7ffc
SHA512 e349a0d909e1b9caffc6c19bebebda30ce6bdeedc54c4646759b3f076ad59510d4a0692205a5094381f936d0cd7c0d534edbdf3213ab4d10cfa9ab95f5d3ea0c

C:\Windows\SysWOW64\omsecor.exe

MD5 b24ff15c3ffb75f2e8825120601fd8b3
SHA1 d3e4d5299844e84a3bb2c52af6cbfe6ff165428e
SHA256 a14c5c65881458cd21db238bd2c200e263c493cecc4b6ba134f6aa5567b75bab
SHA512 7ca810624515b4977002a806a53cd23ab1e435e2bea62dfb5623efce15217495e8d6fa21d6b472a9c4b58b216940797d6633e196f892913d71b1cde877e27a2a

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 08:20

Reported

2024-06-12 08:23

Platform

win7-20240611-en

Max time kernel

145s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2af1f38945e189655455fe1302bd76f0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2af1f38945e189655455fe1302bd76f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2af1f38945e189655455fe1302bd76f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1900 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\2af1f38945e189655455fe1302bd76f0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1900 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\2af1f38945e189655455fe1302bd76f0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1900 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\2af1f38945e189655455fe1302bd76f0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1900 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\2af1f38945e189655455fe1302bd76f0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3004 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3004 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3004 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3004 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2820 wrote to memory of 2272 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2820 wrote to memory of 2272 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2820 wrote to memory of 2272 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2820 wrote to memory of 2272 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2af1f38945e189655455fe1302bd76f0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2af1f38945e189655455fe1302bd76f0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 8134ebc571ffdcfecd410e0a271b694c
SHA1 70b382f8f550650276ee143ff51c2ffa9c770ab6
SHA256 36618a470c0e24d6a3064c7967be8cdab13878ee81d886578ae8d2e4b84f7ffc
SHA512 e349a0d909e1b9caffc6c19bebebda30ce6bdeedc54c4646759b3f076ad59510d4a0692205a5094381f936d0cd7c0d534edbdf3213ab4d10cfa9ab95f5d3ea0c

\Windows\SysWOW64\omsecor.exe

MD5 df12532236f4b8cc24be1a27f94eff6d
SHA1 30031dcf364d8796cd5ce22639f10dfede59efb5
SHA256 b24f9018a3b343b6cbd82e2d48f900b7e39b14e4f21f033c359779d43f3b27c7
SHA512 0a6e2226d0ec1841aba3c1fbcb67c15b2f1316b170cefcdd8e37d31e16e916189101815dbc29d2d57d607e76fef80e0491b7ceb0a634dcb27ea89192561e0b95

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 62748c24a24e816c554cbc982bfde66d
SHA1 7dffcde62fd6c8e9fdacb8caa5b1dadaf3d67b3a
SHA256 d06b937a25230ec9129e003e86b890239321ee484b8ea1ce561a16d6a3623f29
SHA512 fc7f9cfbea8b51d15445309a9be9f0917a7d74cda69bd10b27521c29de6c47c679318e45d40c14c424e2614068d3191c332e523ebb88ec33848e7d0b4a1c913a