Malware Analysis Report

2024-09-11 08:22

Sample ID 240619-r4rj4axapk
Target c51269ecfba52522b656037a356020e0_NeikiAnalytics.exe
SHA256 59114008f7425fb64278ed47b696fae3cfd4fded09a69cb33f733e030eed5822
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

59114008f7425fb64278ed47b696fae3cfd4fded09a69cb33f733e030eed5822

Threat Level: Known bad

The file c51269ecfba52522b656037a356020e0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-19 14:45

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-19 14:45

Reported

2024-06-19 14:47

Platform

win7-20240611-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c51269ecfba52522b656037a356020e0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c51269ecfba52522b656037a356020e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c51269ecfba52522b656037a356020e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1808 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\c51269ecfba52522b656037a356020e0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1808 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\c51269ecfba52522b656037a356020e0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1808 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\c51269ecfba52522b656037a356020e0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1808 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\c51269ecfba52522b656037a356020e0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2216 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2216 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2216 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2216 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2848 wrote to memory of 2804 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2848 wrote to memory of 2804 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2848 wrote to memory of 2804 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2848 wrote to memory of 2804 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c51269ecfba52522b656037a356020e0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\c51269ecfba52522b656037a356020e0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 e14c0ca8649476e8745d70fb35f05623
SHA1 6685214d6985f92a72b7b3c4abefeb585901519c
SHA256 d6e9e82fe955306e44cb28de1e9378c9f1c1168de78591415695bc831b69b2ff
SHA512 b1b1a6b2d788fb676cca7b5d2d4a620ee8db61249ae246d793077a74557c9e2222cac1623b5025ae41ece020683736c8cbb6b3ef4da641963dfe65073de9e332

memory/2216-9-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1808-1-0x0000000000400000-0x000000000042B000-memory.dmp

memory/2216-11-0x0000000000400000-0x000000000042B000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 5ef5d3b69af54d9cf9ec8b44ae305e56
SHA1 05d5d67bc60480d1c3ac7bd99f636c99d74f82b2
SHA256 d0d57a4e653b6a585976b16e7ebb67857840714dcf03acb7008fa5f616f9e75d
SHA512 610ff50e9a0a6b33b092b13af1822a5a804727b146a30b450d96a8e66fbe155608e8875a7e0bf22105f1c225a5873cd8533a63e598512bb04d891e5a73a2fa59

memory/2216-16-0x00000000002C0000-0x00000000002EB000-memory.dmp

memory/2848-26-0x0000000000400000-0x000000000042B000-memory.dmp

memory/2216-22-0x0000000000400000-0x000000000042B000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 6bca1c9b4c05bb24b0bce6bf3b4ad687
SHA1 d9a392a10d116c051197137e69b031532a02cb4f
SHA256 289199263f0a2882b347a061622784d4dd5abfda20cd11613c6721190c191a86
SHA512 fec898bb1977d4651981591f74eb9f4052eecfc38538cfb4fd528af469e5c9aef9672ea9f6c1479bfc74ff09ab67ec4831e5517d210277d6efd8e5cbc4ff8384

memory/2848-29-0x0000000000220000-0x000000000024B000-memory.dmp

memory/2848-34-0x0000000000220000-0x000000000024B000-memory.dmp

memory/2804-36-0x0000000000400000-0x000000000042B000-memory.dmp

memory/2804-38-0x0000000000400000-0x000000000042B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-19 14:45

Reported

2024-06-19 14:47

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c51269ecfba52522b656037a356020e0_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
File opened for modification C:\Windows\SysWOW64\merocz.xc6 C:\Windows\SysWOW64\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4848 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\c51269ecfba52522b656037a356020e0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4848 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\c51269ecfba52522b656037a356020e0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4848 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\c51269ecfba52522b656037a356020e0_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1596 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1596 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1596 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c51269ecfba52522b656037a356020e0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\c51269ecfba52522b656037a356020e0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 lousta.net udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 8.8.8.8:53 ow5dirasuek.com udp

Files

memory/4848-0-0x0000000000400000-0x000000000042B000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 e14c0ca8649476e8745d70fb35f05623
SHA1 6685214d6985f92a72b7b3c4abefeb585901519c
SHA256 d6e9e82fe955306e44cb28de1e9378c9f1c1168de78591415695bc831b69b2ff
SHA512 b1b1a6b2d788fb676cca7b5d2d4a620ee8db61249ae246d793077a74557c9e2222cac1623b5025ae41ece020683736c8cbb6b3ef4da641963dfe65073de9e332

memory/1596-4-0x0000000000400000-0x000000000042B000-memory.dmp

memory/4848-5-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1596-7-0x0000000000400000-0x000000000042B000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 0fd1d9bbf59f212edcbcb9c35acd4ccf
SHA1 19866674a2e10e6ebd8682d686b1235232f774a3
SHA256 dddf8a944642b1e5623510af8a7a1bd6ee892ec9c86f7529a811d31f0a0c6b99
SHA512 5b6b242672c2e69d93878d2ebca2466eaf8269d32c4ab645e1ded7e9482fa11bafd2fb8ad4b84ddce7c06572a3b60ead53611b59d914467b776c5a86fc50888d

memory/1596-11-0x0000000000400000-0x000000000042B000-memory.dmp

memory/3884-13-0x0000000000400000-0x000000000042B000-memory.dmp

memory/3884-14-0x0000000000400000-0x000000000042B000-memory.dmp