neconyd | 64b758be7bffd95a71519747729f5b2593f0a7feaa2c7399b292211f0339aaed

Analysis

max time kernel
144s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 23:37

Target
264cf4cfd6fec9dd7abdb3bf784bfd60_NeikiAnalytics.exe
Size 84KB
Sample240518-3mfl2sef44
SHA256 64b758be7bffd95a71519747729f5b2593f0a7feaa2c7399b292211f0339aaed
MD5 264cf4cfd6fec9dd7abdb3bf784bfd60
SHA1 c4887e40c4247978a0e49393c55efbce8e3cec86
SHA512 ebdba0214a3e4e333a20b2988c8810e22d1d5b15b844d776918d8fb528be40b7735ef05a1f5324a507dd8ce6daf3eb42a2a735310d382a5432bc627d58b02437
SSDEEP 1536:Ad9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:gdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
5004	omsecor.exe
4320	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 5004	3868	264cf4cfd6fec9dd7abdb3bf784bfd60_NeikiAnalytics.exe	89
PID 3868 wrote to memory of 5004	3868	264cf4cfd6fec9dd7abdb3bf784bfd60_NeikiAnalytics.exe	89
PID 3868 wrote to memory of 5004	3868	264cf4cfd6fec9dd7abdb3bf784bfd60_NeikiAnalytics.exe	89
PID 5004 wrote to memory of 4320	5004	omsecor.exe	99
PID 5004 wrote to memory of 4320	5004	omsecor.exe	99
PID 5004 wrote to memory of 4320	5004	omsecor.exe	99

C:\Users\Admin\AppData\Local\Temp\264cf4cfd6fec9dd7abdb3bf784bfd60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\264cf4cfd6fec9dd7abdb3bf784bfd60_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1040 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:2500

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 ac4a85d27cc1a473a69bc4c2623abf2fbadb24ac4a4dee5913a8aeeccbcb3a6a
MD5 473bafb789780c66c5301447459908d0
SHA1 d1cda8c1a1c7c894512fa57d920dcf142a80b633
SHA512 d1eeb95200d00d5a076c287c9504b98e9d1b2236e50effd221d812b3ad04f200d3258cbdd7e7f5a722b18181dc8a4a73c188f8b5e3251da68015b50317049773
SSDEEP 1536:rd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:bdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 d727488df5d69384b049a70c663b3c58bf3351c73ba0503bb689433c2ec42125
MD5 5401a0c7e6cb855d1cb5ceecdcef964f
SHA1 2e8a18ee8fb44abc7d7d45467873e4a17f96cbc0
SHA512 0749588183aac7940372da6f6fb98f6ccadef58b26d6d4fa5e107f42a91c7b7868c46bf30bf53595e606ab5ec4055010e19eb74807a151563f23d132e7aa19a3
SSDEEP 1536:Jd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:JdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download