Malware Analysis Report

2024-09-11 08:23

Sample ID 240617-cnyk5szcme
Target 34da1b0e0844725559275ea4a55c52b0_NeikiAnalytics.exe
SHA256 b97438ab261c8e334e6d6d20ab8480264b33f0749d991d04694a1de8e291dc73
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b97438ab261c8e334e6d6d20ab8480264b33f0749d991d04694a1de8e291dc73

Threat Level: Known bad

The file 34da1b0e0844725559275ea4a55c52b0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-17 02:13

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 02:13

Reported

2024-06-17 02:16

Platform

win7-20240508-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\34da1b0e0844725559275ea4a55c52b0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\34da1b0e0844725559275ea4a55c52b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\34da1b0e0844725559275ea4a55c52b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1192 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\34da1b0e0844725559275ea4a55c52b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1192 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\34da1b0e0844725559275ea4a55c52b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1192 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\34da1b0e0844725559275ea4a55c52b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1192 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\34da1b0e0844725559275ea4a55c52b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1244 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1244 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1244 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1244 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1708 wrote to memory of 2160 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1708 wrote to memory of 2160 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1708 wrote to memory of 2160 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1708 wrote to memory of 2160 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\34da1b0e0844725559275ea4a55c52b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\34da1b0e0844725559275ea4a55c52b0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 324045731cc5e0659c56f82aaa2a1b18
SHA1 479711e87e126c9f300208df4c0ee2a589203d71
SHA256 e6a447dfbe0793b7614da4e68c3eaa1fa40a093cdf9db27140b1287e8e09b085
SHA512 b8f6f042b99aa82a7b9df33ce2b54482d3d0ec9852a30c99e60335203f80d2fd4d5c326770296dd0ff079246eeab9337ef85bd4503b50768c6c8cf93091e2ffb

\Windows\SysWOW64\omsecor.exe

MD5 70bc118fa367e66e30f60d8a0f898d80
SHA1 6ff4f2e5e3ac974b6065ee74d7aa9a7118d88718
SHA256 356d8334b1b8fa3cfdf6b4b865d728359cac4579d7cb7dee14af230f8f9a4682
SHA512 63a67a8d6acf0093308a0c9ed94d57eb7b8330db403db1f9d9e5a5444db1f5f8ec7fb0385cfaba175a2ece7cbf954399ff414b627799b82e3265a4245d197474

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 dc41fd707b0b6345a88a6d087a6bbea2
SHA1 fe39d783072bd7a2b403740dbf032adee138cfcc
SHA256 570a79117218aeaf2130008b4549fe19b26c6d0a1983a918a2a6874e79b81cda
SHA512 e535f32e631c6cb404c7185c2f2eabbd915e357789fbc6a05f2f24903070bff4392af9833be0a28a70438dd7608aa33c3eb840129e06af8d5a97ad60ea98b173

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 02:13

Reported

2024-06-17 02:16

Platform

win10v2004-20240611-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\34da1b0e0844725559275ea4a55c52b0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1264 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\34da1b0e0844725559275ea4a55c52b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1264 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\34da1b0e0844725559275ea4a55c52b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1264 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\34da1b0e0844725559275ea4a55c52b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1200 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1200 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1200 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1048 wrote to memory of 2276 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1048 wrote to memory of 2276 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1048 wrote to memory of 2276 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\34da1b0e0844725559275ea4a55c52b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\34da1b0e0844725559275ea4a55c52b0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3892,i,3549704109630749084,1975543916261970610,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:8

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 324045731cc5e0659c56f82aaa2a1b18
SHA1 479711e87e126c9f300208df4c0ee2a589203d71
SHA256 e6a447dfbe0793b7614da4e68c3eaa1fa40a093cdf9db27140b1287e8e09b085
SHA512 b8f6f042b99aa82a7b9df33ce2b54482d3d0ec9852a30c99e60335203f80d2fd4d5c326770296dd0ff079246eeab9337ef85bd4503b50768c6c8cf93091e2ffb

C:\Windows\SysWOW64\omsecor.exe

MD5 7180892e8d14400c7806c8e71da448ce
SHA1 d38e582fa96efde66defe31b279019babbae03ea
SHA256 bfc236c7a6eab2b24ab58262c26a6b2de02e2ff0b7ce1faa16aedc70b5e4b4a9
SHA512 32f52d8caeb2577d29f7c254b478655bb542221b71fdd0dbfb0bc83e99e367dbd7eb4734c2cf69a67ed2b50a0ed102e68b5819e7e994222eac697c7bd1d17b94

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 29cfae38bace22130ce859e97f333148
SHA1 749ce429a0c0a6e1f602501f7579cdbe2f879d1a
SHA256 910628595d7d00d423783f84e1a14416a2223c4173c02a200128c3e4abd93ca4
SHA512 0e91b36f1ae3e0e96c25d87ecc4e048d7d580dfae51a0e3097d1da1193a59d12dd2c9d3a745f51826b44d467737fdfacdf48077538e2257417811463cf1b791a