Malware Analysis Report

2024-09-11 08:28

Sample ID 240620-dhxx4avfnc
Target 2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d_NeikiAnalytics.exe
SHA256 2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d

Threat Level: Known bad

The file 2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-20 03:01

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 03:01

Reported

2024-06-20 03:03

Platform

win7-20240611-en

Max time kernel

145s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2024 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2024 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2024 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2024 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2856 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2856 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2856 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2856 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1660 wrote to memory of 1948 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1660 wrote to memory of 1948 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1660 wrote to memory of 1948 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1660 wrote to memory of 1948 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2024-0-0x0000000000400000-0x000000000042B000-memory.dmp

memory/2024-10-0x0000000000400000-0x000000000042B000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 b1cb404d160cb242c92680f06300a141
SHA1 ed38781896d6016816054ea84b18a313fd37df01
SHA256 d1ed9d421c6222b537b5e122c50144783048626a4f4e3399ab77fd6c92f6ae72
SHA512 0e40395b9a8ccb6b5301da10d8904f64a6c15f165ceb280e15073ec272b1e23097f38fcf83182a1e26e0548f58b2dadd99e511ddd3adbeeddb1bc41e05d3efdf

memory/2024-9-0x00000000002C0000-0x00000000002EB000-memory.dmp

memory/2024-4-0x00000000002C0000-0x00000000002EB000-memory.dmp

memory/2856-13-0x0000000000400000-0x000000000042B000-memory.dmp

\Windows\SysWOW64\omsecor.exe

MD5 8bbb7fe2ad64eceb091b4132397b28e6
SHA1 25e7e5b9bf75f6013d9eb295d6c6f1c613b5d0ec
SHA256 e5f7fc0faae582fcf56a8a869c5e9d3f8f634e84f0c5cc595175b0f52050fedb
SHA512 b9c5a700046dc0b56c7b8679c41b261f7bcb470e7eaad6405fe9d20bffc0259b249ffe6559ad1048d8c222378d5061e7a49cfabfb55dc417302cccc3e5f568f3

memory/2856-18-0x0000000000440000-0x000000000046B000-memory.dmp

memory/2856-24-0x0000000000400000-0x000000000042B000-memory.dmp

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 3e57d0171831b8725e08852bd2e5907a
SHA1 140ee4fb80689532cb823a1f30f5a268dcb78925
SHA256 0fb24fa940af1f4404fad5ff0749dfa1e76e5f6c9e3b1028703da12d82347d1c
SHA512 15964e853dda5262158029bb5d9ff5009cbc243088a3fda5f2b36d79fb4fcfe507040ed42457da68844facae8eb7508e16d4012e784bdee60e117ca0699c772a

memory/1948-36-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1660-34-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1948-38-0x0000000000400000-0x000000000042B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 03:01

Reported

2024-06-20 03:03

Platform

win10v2004-20240611-en

Max time kernel

145s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d_NeikiAnalytics.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
File opened for modification C:\Windows\SysWOW64\merocz.xc6 C:\Windows\SysWOW64\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2456 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2456 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2456 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1512 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1512 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1512 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2c71a105e35323d85221d06c9afe678b1d3c559c66b8f480b3921884da031a9d_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

memory/2456-1-0x0000000000400000-0x000000000042B000-memory.dmp

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 b1cb404d160cb242c92680f06300a141
SHA1 ed38781896d6016816054ea84b18a313fd37df01
SHA256 d1ed9d421c6222b537b5e122c50144783048626a4f4e3399ab77fd6c92f6ae72
SHA512 0e40395b9a8ccb6b5301da10d8904f64a6c15f165ceb280e15073ec272b1e23097f38fcf83182a1e26e0548f58b2dadd99e511ddd3adbeeddb1bc41e05d3efdf

memory/1512-4-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1512-6-0x0000000000400000-0x000000000042B000-memory.dmp

C:\Windows\SysWOW64\omsecor.exe

MD5 dc789fde52e3d860427265f274ce195f
SHA1 b03431634bc38d23193478c78bd18053139da507
SHA256 19b6ad45a31a4191718ac4da3492879df07480072643ef25576f102e8878c399
SHA512 8349aaa3922c5c3997eb36c167d146d61b4f92233824a581fe8a22da5fece14f7e68b89dfada37ef1dd01129749f1222bc9a1626060ab1bc5687852690a6d02d

memory/1512-11-0x0000000000400000-0x000000000042B000-memory.dmp

memory/3904-12-0x0000000000400000-0x000000000042B000-memory.dmp

memory/3904-13-0x0000000000400000-0x000000000042B000-memory.dmp