neconyd | 2e0c161fce0d09adae13faf99a8186ae50849f7d20506d5770a87676ab54e99b

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 18:20

Target

10cf540cfab3306b09cc857abb417490_NeikiAnalytics.exe
Size

88KB
MD5

10cf540cfab3306b09cc857abb417490
SHA1

68ca1753e59452928dbd56711448485c2853df75
SHA256

2e0c161fce0d09adae13faf99a8186ae50849f7d20506d5770a87676ab54e99b
SHA512

96779c175a5885ac162a272fbf4801d4e5174ed6af0da65943bccfe92e9f2ed2e72de99645bcbbe9ed489c33abedff93321073df0408cc61023d6403332a2cb6
SSDEEP

768:bMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:bbIvYvZEyFKF6N4yS+AQmZTl/5

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Executes dropped EXE 3 IoCs

Loads dropped DLL 6 IoCs

pid	Process
2428	10cf540cfab3306b09cc857abb417490_NeikiAnalytics.exe
2428	10cf540cfab3306b09cc857abb417490_NeikiAnalytics.exe
2592	omsecor.exe
2592	omsecor.exe
2604	omsecor.exe
2604	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2592	2428	10cf540cfab3306b09cc857abb417490_NeikiAnalytics.exe	28
PID 2428 wrote to memory of 2592	2428	10cf540cfab3306b09cc857abb417490_NeikiAnalytics.exe	28
PID 2428 wrote to memory of 2592	2428	10cf540cfab3306b09cc857abb417490_NeikiAnalytics.exe	28
PID 2428 wrote to memory of 2592	2428	10cf540cfab3306b09cc857abb417490_NeikiAnalytics.exe	28
PID 2592 wrote to memory of 2604	2592	omsecor.exe	32
PID 2592 wrote to memory of 2604	2592	omsecor.exe	32
PID 2592 wrote to memory of 2604	2592	omsecor.exe	32
PID 2592 wrote to memory of 2604	2592	omsecor.exe	32
PID 2604 wrote to memory of 2240	2604	omsecor.exe	33
PID 2604 wrote to memory of 2240	2604	omsecor.exe	33
PID 2604 wrote to memory of 2240	2604	omsecor.exe	33
PID 2604 wrote to memory of 2240	2604	omsecor.exe	33

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
88KB

MD5
18cc801f08b4de4f3f7d41f4448cec3f

SHA1
31cda61c703402aef945a3bfea1a72580f1b31f1

SHA256
f473ca71f5de1c76c54a2ffe5c7bf945812ff8fcc0036a0268ae0cba82c06e32

SHA512
3f6d059cf9ca536cf2f9d6947b3ece2cd6515587ef37ffc193900d204d0d5c1672f7b90099dc7a5746b28edc7586c8cde1d670b046fe0c57d8e8943f9d131ddd

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
88KB

MD5
33fdd740c6c813fa627b6af11c9fc323

SHA1
a8e33f4c276164c0c4d34b3a0af8d75435b998f4

SHA256
c1a37a484b4f65ea5cf1528314db1ca035284a3d2a73609e6058a621aa2106c9

SHA512
60ecd00e9ee5febcc9a579421e9173788968900a23b45404a32ccabda2403b9d6c13c28b402d5566db913432e5be3ec761538a7f2c0a3ad69004a02849988bf6

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
88KB

MD5
e82153d51b4be5215fe12420bb047bf8

SHA1
1ef724db7338a79e08711978b20a59b00d5e66b9

SHA256
35b8d7e3ca75419e987730699aca00eca356af9e6babfd1b041d1252aae74cdd

SHA512
8518c87677a9d53ade284f30cf48884ba7df850a82324cb3ff1ec14900298afc785e2a7e3cb58dcbabb165b080b32b9a695002e398457ad0965c0e11c97ee2af

Download Submit