neconyd | a4a9a3c2a1cd8b41f5e583effda14de904cf5f873bde8830ebc373445cace3a2

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 23:23

Target
221ca22ca802cd0b98f468f8339f24b0_NeikiAnalytics.exe
Size 64KB
Sample240518-3db79sdf5x
SHA256 a4a9a3c2a1cd8b41f5e583effda14de904cf5f873bde8830ebc373445cace3a2
MD5 221ca22ca802cd0b98f468f8339f24b0
SHA1 34a600790c2955a66705269dc54ab5ef968c758b
SHA512 d88bac273295057c34200a83bc32e5ecce715fdcf47d398ff976c4b73d98ed5eb02f0908641e42aa992c4275abd0df141043dd5f8d6e4edb129f44cb1c75b6b2
SSDEEP 768:jMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:jbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
3916	omsecor.exe
2972	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 3916	3952	221ca22ca802cd0b98f468f8339f24b0_NeikiAnalytics.exe	82
PID 3952 wrote to memory of 3916	3952	221ca22ca802cd0b98f468f8339f24b0_NeikiAnalytics.exe	82
PID 3952 wrote to memory of 3916	3952	221ca22ca802cd0b98f468f8339f24b0_NeikiAnalytics.exe	82
PID 3916 wrote to memory of 2972	3916	omsecor.exe	100
PID 3916 wrote to memory of 2972	3916	omsecor.exe	100
PID 3916 wrote to memory of 2972	3916	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\221ca22ca802cd0b98f468f8339f24b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\221ca22ca802cd0b98f468f8339f24b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:2972

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 69270a48e86f128ce4c873c0f40b074f865bf2f70237c5d3bd1627c91051e443
MD5 a584fe0a1fb20d46daa275e8ea47646a
SHA1 96071eb0f710faa9e278fc2bcffe6f48df5aabfa
SHA512 e1e21fe9329565cc80efe05ac21539dad74e76a096d682ba306a492e34c759979956e0557cbe2a0e07ce747720d9ab7caf3d901df58a17685fd4694fb455ea90
SSDEEP 768:LMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:LbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 64KB
SHA256 275e5ba2a737b4af7e93e2a40f7feeb583bf63b5316d65fdbd08c40276597f71
MD5 d8589b0ebcfdd307857c65ef27b35414
SHA1 7fc2f5d859ebe3df54af8cc564f8acbcd6cf988e
SHA512 d80f5e33a1dc10ffdd2744b5f909853fae6c4d5af18dafede5ea0cf287a63f0b62e9039ef56aede1f8010a2f64e9657e76eacee338ee4c046fab1562d198e5de
SSDEEP 768:cMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:cbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download