Malware Analysis Report

2024-09-11 08:26

Sample ID 240617-c99was1blb
Target 399e9f706b569183e965401e81df1540_NeikiAnalytics.exe
SHA256 f41d72e0c8cacd3a64e389bbae5dbb4cad8f22bc959c0c3e31ce836b8d452046
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f41d72e0c8cacd3a64e389bbae5dbb4cad8f22bc959c0c3e31ce836b8d452046

Threat Level: Known bad

The file 399e9f706b569183e965401e81df1540_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-17 02:47

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 02:47

Reported

2024-06-17 02:50

Platform

win7-20231129-en

Max time kernel

145s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1720 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1720 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1720 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1720 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2176 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2176 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2176 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2176 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2700 wrote to memory of 1876 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2700 wrote to memory of 1876 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2700 wrote to memory of 1876 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2700 wrote to memory of 1876 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 cd0f9616a781a75fe18bea70bfe97cb8
SHA1 b084fae9667842ccdc17b55d52bc528df279febf
SHA256 bfd5881c9c8b85a46cf8c76a138e7f1b8022157b053e6f2bb84134628bf0eef8
SHA512 2715d74e361899dda8bf7dc4f2212755d6b4f6bf1bab457d8d01a1d336b76cc98e523b1878d3398f3502ea101ca2cf6f710761362b1b07c486ee7221d5e193bf

\Windows\SysWOW64\omsecor.exe

MD5 9b98e0ce19304a5106ddac0b5dff4b1a
SHA1 8e85e3e443ed86addbc0328cc1fb9b00a684cb01
SHA256 e79cb85695b13808144bbf0072844773e883aa0ba8e497da38eb09697473c3db
SHA512 0d66ec0228cd92b264857f8cbd88467e7c5e54b8b0e3ad51c4dc2a46188b710657a11cdeb0a537b861e3d43d6847e324608ed20fab5d23f49304f48a763c77b6

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 ca57e62b4d968efdf63f4f97b18ee7e7
SHA1 058c3268e8328ac57b2c129b4b3470940957f671
SHA256 516ceb97a4dbfc586d4f80219619dd350d09166688ccf1cf446da749937bebbf
SHA512 ffd05c05d749298faae084db2f85345a54b14949fc500ce8617c7393d68b1fdb9ac1076777652333fde55432198f33c1507b59470d54beac18194a4c0374b485

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 02:47

Reported

2024-06-17 02:50

Platform

win10v2004-20240611-en

Max time kernel

145s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3936 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3936 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3936 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 3292 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3292 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 3292 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4796 wrote to memory of 1632 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4796 wrote to memory of 1632 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4796 wrote to memory of 1632 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 57.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 cd0f9616a781a75fe18bea70bfe97cb8
SHA1 b084fae9667842ccdc17b55d52bc528df279febf
SHA256 bfd5881c9c8b85a46cf8c76a138e7f1b8022157b053e6f2bb84134628bf0eef8
SHA512 2715d74e361899dda8bf7dc4f2212755d6b4f6bf1bab457d8d01a1d336b76cc98e523b1878d3398f3502ea101ca2cf6f710761362b1b07c486ee7221d5e193bf

C:\Windows\SysWOW64\omsecor.exe

MD5 868ba48daa09e76f18f3121ca6c7774b
SHA1 1734f14cae70a31dd767e2e1820dc28e2c5620b0
SHA256 d55fc511b03e99e6a82fc1df90b19a1e12723683fc27097143516c35545a7771
SHA512 0bc6da64ca4eaf1fe2cff055064d362dba24ba8f53772a7ad6a0e39615ca9f78a7405427cd6f17066a0644ede07f3f99bbb99b8709903910894f53b54ee72a28

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 68d9637a731406ed1c0123f8380f1c45
SHA1 43eb54b5006e488a67a350b1f7940081ac462802
SHA256 60c51aa145216915c2a73950c100b8c4b6d2cbec599b4dfab039478f7f7f9178
SHA512 5bb422eb9347838595022ae7f6d361cc4ea284831b8efa09920d5256d78eee1094cd8a62de38ccb2d90f50d017489e75f9e7cec7a4e244a34b90e803640107b4