Malware Analysis Report

2024-09-11 08:31

Sample ID 240616-allgpavdpm
Target c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe
SHA256 246853272f5acc357c940f93cdcde0f2479ef4e077f670bf2954954080a897b7
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

246853272f5acc357c940f93cdcde0f2479ef4e077f670bf2954954080a897b7

Threat Level: Known bad

The file c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd

Neconyd family

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-16 00:18

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 00:18

Reported

2024-06-16 00:20

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 932 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 932 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 932 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1932 wrote to memory of 3132 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1932 wrote to memory of 3132 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1932 wrote to memory of 3132 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3132 wrote to memory of 5060 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3132 wrote to memory of 5060 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3132 wrote to memory of 5060 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3044,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 142.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 fe443b2af0fd0c3593f909b282184626
SHA1 db441de3f64fbfde46dccffe7e46518988bd0134
SHA256 c0b4e8f10d0bc70360a086061710b547e800339c4d8e6d4ab833f093631ca9e4
SHA512 f8f4da9770e6336c3c8dda6cb7cc3b3c481bed5d25ee63b78cda03a26c5329826ce852a63e19dba1aa73a9754f3db18aa48b5541c72aafc86981d9a686a1b3c8

C:\Windows\SysWOW64\omsecor.exe

MD5 4f5fdf34333ccb2627568d4cbeb8963c
SHA1 554290dd00786b739ec0a7391bb52d55219781f6
SHA256 8e8c47b3e359c8aaccdd741fff9e61a4f8c8ee3b096f6c0d771ff8cc336806c9
SHA512 1880774cc6290d879bc0673164b9d11e6db2095f35ae527c4c3fb3a89aad6c964d5134562edbe0c7701fa611abc2c91d9e4f85e2531d21416b099568dc0b6033

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 1265093e47a4355598537e490efc60f5
SHA1 b18e3fbc0fd69e9d5c3f86d3a690ad51b17b5bd3
SHA256 7752d2258466905bab25212fa1fa956686ba788ccb090a649562108214823245
SHA512 c285669c012099f1015e4200dd874ab15ae35a34cc6b177466a9d38fc93803650929df3c08b692a14c14b17acdd06062b35b3ba1a3094624fb2382c2754122c1

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 00:18

Reported

2024-06-16 00:20

Platform

win7-20240611-en

Max time kernel

149s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1176 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1176 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1176 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1176 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2376 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2376 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2376 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2376 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2988 wrote to memory of 1964 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2988 wrote to memory of 1964 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2988 wrote to memory of 1964 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2988 wrote to memory of 1964 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 tcp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 fe443b2af0fd0c3593f909b282184626
SHA1 db441de3f64fbfde46dccffe7e46518988bd0134
SHA256 c0b4e8f10d0bc70360a086061710b547e800339c4d8e6d4ab833f093631ca9e4
SHA512 f8f4da9770e6336c3c8dda6cb7cc3b3c481bed5d25ee63b78cda03a26c5329826ce852a63e19dba1aa73a9754f3db18aa48b5541c72aafc86981d9a686a1b3c8

\Windows\SysWOW64\omsecor.exe

MD5 5fe7580946828884f15d713f8aa3f9d5
SHA1 6704429b189dfa92e13eaeb73be22d09802e8651
SHA256 ded611acd1125f8b78e7ed3f51888dbb7e108e8dd8de0b01a77e61bb0133bc35
SHA512 0dab5f87dfc88ffc49eae86314c40553d63da3eb1eab5114f8f26aff9cb6f86465ea81d332bacb16d628d51f70ac692ef77e00e2fa3e97c8b42071f33c016d2f

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 69f5f0bacfe44e56948aea22374d18a9
SHA1 1caea7f5f24222e58f00fc87aef62309075aa9fa
SHA256 2b25b88e653238b8cc7aa4b0a19c55475df70b338756e3ca8653eb494353c639
SHA512 49a4109a1e53246e1d2edc240a8b4e7bbc8a61e052c6de18f792d4ac30242822e25694b982739ebba63fb69c9cb72e510c042c754f7ff372f05ff272ae8bb356