neconyd | 6426541909063a8c76245eb0f89204ec1725f8fcf7a51e5aac71ab106d3710e2

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 15:14

Target

e2ba582e7aa4409173f1327a1dc724d0_NeikiAnalytics.exe
Size

72KB
MD5

e2ba582e7aa4409173f1327a1dc724d0
SHA1

6030f0130e9edd7bfb66d2ba7d128e4b2814202f
SHA256

6426541909063a8c76245eb0f89204ec1725f8fcf7a51e5aac71ab106d3710e2
SHA512

335c2769032a60b1554ab5b7484bdef1ba0e8cc4a4b3bfa44311593d2043b56f8f9c714389bb4834be6b262566d1369ea17e5f59625e1cab9dea300f364464de
SSDEEP

768:7MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:7bIvYvZEyFKF6N4yS+AQmZTl/5O

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Executes dropped EXE 3 IoCs

Loads dropped DLL 6 IoCs

pid	Process
1924	e2ba582e7aa4409173f1327a1dc724d0_NeikiAnalytics.exe
1924	e2ba582e7aa4409173f1327a1dc724d0_NeikiAnalytics.exe
2060	omsecor.exe
2060	omsecor.exe
1348	omsecor.exe
1348	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2060	1924	e2ba582e7aa4409173f1327a1dc724d0_NeikiAnalytics.exe	28
PID 1924 wrote to memory of 2060	1924	e2ba582e7aa4409173f1327a1dc724d0_NeikiAnalytics.exe	28
PID 1924 wrote to memory of 2060	1924	e2ba582e7aa4409173f1327a1dc724d0_NeikiAnalytics.exe	28
PID 1924 wrote to memory of 2060	1924	e2ba582e7aa4409173f1327a1dc724d0_NeikiAnalytics.exe	28
PID 2060 wrote to memory of 1348	2060	omsecor.exe	32
PID 2060 wrote to memory of 1348	2060	omsecor.exe	32
PID 2060 wrote to memory of 1348	2060	omsecor.exe	32
PID 2060 wrote to memory of 1348	2060	omsecor.exe	32
PID 1348 wrote to memory of 1844	1348	omsecor.exe	33
PID 1348 wrote to memory of 1844	1348	omsecor.exe	33
PID 1348 wrote to memory of 1844	1348	omsecor.exe	33
PID 1348 wrote to memory of 1844	1348	omsecor.exe	33

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
124757867d88a61595e9e9a5f2d32431

SHA1
7e2ff28b52c4ade7034b157c4e43409f63197b92

SHA256
a4cb4ea1ce2b4a9899579fd1a72a5327056e66e388ee19618a466ede94f7f1f6

SHA512
09d2022374452b36bf2c8b24f85b64431de9c21f83523fa60ebedc40ec4bf7153b8a301c8a8026cc8b799b6b3555813632e3e1b355afa020f4013cd25b8c116b

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
455ab38364919cce3c2d204415af12c9

SHA1
744a89d6b1672e90c85de20321d03b353b8358e1

SHA256
a435b8f8a9dc6a38aec966db337d00c8d0e2b3ded9618d8b850a7ca312d75fae

SHA512
672915499a803f01c9f69e369fa199973f3ee26c515ed7c959040b5106b9334d1483b5f171dcf159810c3316d166f7586573b547475092cc4312e5bbc7f0d182

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
72KB

MD5
8f37a1a591f51f0920c86707dffd8e9a

SHA1
8f329748df7657b07e497306aca99834768f4fa8

SHA256
d1e00316baf853764b8c7dd9323bd09683652d60350e478275a0ca53ec82d00c

SHA512
19dd7a7cb8420a320f0b7e20a2354a7a940e91d76a78eac95b197a0b349fbb60e1103d04b0e6011ec3148dd40f4ab5a795b99aaebfd8ef5885f0ea5bcd3473bf

Download Submit