neconyd | 9e23d3d9c7ab75c99c2c49d90e5bf0473e1c4679f7dca44d33339f9c6a629ccc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 08:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b3696771f72afbda8ea42e23277e1c90_NeikiAnalytics.exe
Size 84KB
Sample240518-j4qc2abb76
SHA256 9e23d3d9c7ab75c99c2c49d90e5bf0473e1c4679f7dca44d33339f9c6a629ccc
MD5 b3696771f72afbda8ea42e23277e1c90
SHA1 9a54eb61cb0757904a26c0e752ae80b7a206c7bf
SHA512 dbb452edacf628f6c4375a0700e0a52425def5264e99fbebc93d4dce5b1381ca7366c041a27a01f6499deb520fdbeb588e69f62617ccc0cc2689093e43291e38
SSDEEP 1536:vd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:HdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2960	omsecor.exe
4612	omsecor.exe
3248	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2960	2352	b3696771f72afbda8ea42e23277e1c90_NeikiAnalytics.exe	83
PID 2352 wrote to memory of 2960	2352	b3696771f72afbda8ea42e23277e1c90_NeikiAnalytics.exe	83
PID 2352 wrote to memory of 2960	2352	b3696771f72afbda8ea42e23277e1c90_NeikiAnalytics.exe	83
PID 2960 wrote to memory of 4612	2960	omsecor.exe	100
PID 2960 wrote to memory of 4612	2960	omsecor.exe	100
PID 2960 wrote to memory of 4612	2960	omsecor.exe	100
PID 4612 wrote to memory of 3248	4612	omsecor.exe	101
PID 4612 wrote to memory of 3248	4612	omsecor.exe	101
PID 4612 wrote to memory of 3248	4612	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\b3696771f72afbda8ea42e23277e1c90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b3696771f72afbda8ea42e23277e1c90_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 abf91be86d0d48848d762c6d6ec2beccc5005c406eebece39875f73ff1142c3b
MD5 aab75a140694397081a8796a974c025f
SHA1 e9e23e370891c23f74d1b531b8e6f90f1ea9b090
SHA512 0bfbe24787a29bd79b20c340177a835f0b5a7bd214ba4cc8b1beae6ab624a27e04cc8fe73c55e07de73027ffc306766f65db34c82f5a8b7227209000bfe10c54
SSDEEP 1536:Td9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:TdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 a9e597999f33bf4430227a4117c4dbad66d58595cfe46521e5aa1016d3e33626
MD5 b4b4bd58913c858692450fdd80a8550c
SHA1 74407d561a1e197a5d1c59c0953b0f054372b528
SHA512 9df143b168906e93f61ff479b56e9ec520ab225f579591770694077271446f47ccfbc52a1c0924d3a41bcb8271dfbfa2afa0384fa6e0e707a886c789d4d6f3fc
SSDEEP 1536:nd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:PdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 7cd93191a9e3758a4e2b27d7c29e9f1c1385c82e0df9633117a2095252a831de
MD5 5d1eedcb44cee435ccf2fdcbe7f5138a
SHA1 2d0988bee2f70c152fa27e37cdfed3ec8c319444
SHA512 9d0f2cff669a60db69b252911e1b4231210dea38fbc5bb9ae98e0ce69d25a59c2774253e0bd9644cf06ebc77bd585aba2b06f9790e3fc5eb49c2daeea996befa
SSDEEP 1536:bd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:rdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads