neconyd | a4a9a3c2a1cd8b41f5e583effda14de904cf5f873bde8830ebc373445cace3a2

Analysis

max time kernel
146s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/05/2024, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
221ca22ca802cd0b98f468f8339f24b0_NeikiAnalytics.exe
Size 64KB
Sample240518-3db79sdf5x
SHA256 a4a9a3c2a1cd8b41f5e583effda14de904cf5f873bde8830ebc373445cace3a2
MD5 221ca22ca802cd0b98f468f8339f24b0
SHA1 34a600790c2955a66705269dc54ab5ef968c758b
SHA512 d88bac273295057c34200a83bc32e5ecce715fdcf47d398ff976c4b73d98ed5eb02f0908641e42aa992c4275abd0df141043dd5f8d6e4edb129f44cb1c75b6b2
SSDEEP 768:jMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:jbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
776	omsecor.exe
2840	omsecor.exe
2864	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2240	221ca22ca802cd0b98f468f8339f24b0_NeikiAnalytics.exe
2240	221ca22ca802cd0b98f468f8339f24b0_NeikiAnalytics.exe
776	omsecor.exe
776	omsecor.exe
2840	omsecor.exe
2840	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 776	2240	221ca22ca802cd0b98f468f8339f24b0_NeikiAnalytics.exe	28
PID 2240 wrote to memory of 776	2240	221ca22ca802cd0b98f468f8339f24b0_NeikiAnalytics.exe	28
PID 2240 wrote to memory of 776	2240	221ca22ca802cd0b98f468f8339f24b0_NeikiAnalytics.exe	28
PID 2240 wrote to memory of 776	2240	221ca22ca802cd0b98f468f8339f24b0_NeikiAnalytics.exe	28
PID 776 wrote to memory of 2840	776	omsecor.exe	32
PID 776 wrote to memory of 2840	776	omsecor.exe	32
PID 776 wrote to memory of 2840	776	omsecor.exe	32
PID 776 wrote to memory of 2840	776	omsecor.exe	32
PID 2840 wrote to memory of 2864	2840	omsecor.exe	33
PID 2840 wrote to memory of 2864	2840	omsecor.exe	33
PID 2840 wrote to memory of 2864	2840	omsecor.exe	33
PID 2840 wrote to memory of 2864	2840	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\221ca22ca802cd0b98f468f8339f24b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\221ca22ca802cd0b98f468f8339f24b0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 69270a48e86f128ce4c873c0f40b074f865bf2f70237c5d3bd1627c91051e443
MD5 a584fe0a1fb20d46daa275e8ea47646a
SHA1 96071eb0f710faa9e278fc2bcffe6f48df5aabfa
SHA512 e1e21fe9329565cc80efe05ac21539dad74e76a096d682ba306a492e34c759979956e0557cbe2a0e07ce747720d9ab7caf3d901df58a17685fd4694fb455ea90
SSDEEP 768:LMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:LbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 5c8f67f30686dba73225294732732ecef26786e3a2f513da714a27754705e55a
MD5 2d3e68459d24d00f1506a2dec5bd7f2f
SHA1 882f7574e44a30315a8dae2f15ad4a84b706cd5f
SHA512 2826ad4c9ac864e5592fb2e3884d66a8b142fd617e3f44a928e6fab5d5642abe16129a73a82185b2b9818997c8dba284e7b2c942595a3b57c5606d4b6f8001b2
SSDEEP 768:oMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:obIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 64KB
SHA256 84e63824aeac7271aed7306dffe7c298339f0c01e497c50d7e2b0395a20e8e20
MD5 040ce79c42c891bab2609a890e0f5cee
SHA1 6d48f258c722524f563e7af7eda8ecc0b9133487
SHA512 a7cb9b50795fab18911d93d9b3ea050e7dc607a5ba6c713bb92e1423ee70448cd4c8c39621902d57052e8e3a5afdd15357d1dcf57c91961ece62c17b7b042cc5
SSDEEP 768:QMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:QbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads