neconyd | c8cd634e70f873fd6149a028622c672891049695864a284f93ad0090c5207372

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0581f9bed5149ae8530917063a211664_NeikiAnalytics.exe
Size 92KB
Sample240518-ma4kcaef89
SHA256 c8cd634e70f873fd6149a028622c672891049695864a284f93ad0090c5207372
MD5 0581f9bed5149ae8530917063a211664
SHA1 e858235b5aeb928cc3ff6d8ce024d777da312ab6
SHA512 49f1ae67baeba64923f7177c4a7409b08259c1a4932960115e7cd742c864175e1ce33692bf89cfca8f48a149d652a5ba14a77dea0c2bfc86878454d5f0beca58
SSDEEP 768:PMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:PbIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1440	omsecor.exe
4916	omsecor.exe
4448	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 1440	4684	0581f9bed5149ae8530917063a211664_NeikiAnalytics.exe	83
PID 4684 wrote to memory of 1440	4684	0581f9bed5149ae8530917063a211664_NeikiAnalytics.exe	83
PID 4684 wrote to memory of 1440	4684	0581f9bed5149ae8530917063a211664_NeikiAnalytics.exe	83
PID 1440 wrote to memory of 4916	1440	omsecor.exe	100
PID 1440 wrote to memory of 4916	1440	omsecor.exe	100
PID 1440 wrote to memory of 4916	1440	omsecor.exe	100
PID 4916 wrote to memory of 4448	4916	omsecor.exe	101
PID 4916 wrote to memory of 4448	4916	omsecor.exe	101
PID 4916 wrote to memory of 4448	4916	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\0581f9bed5149ae8530917063a211664_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0581f9bed5149ae8530917063a211664_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 97857e6d1709022e911305a9763f6a72c151b9bf67df82e55a337a1826897947
MD5 e14c37fe84b9bbe75d8160375031ca47
SHA1 0b05a3d14a0e5595e963153bab9818fae4942674
SHA512 e19473e448f565e32c497692f5bf7194ed3779937d7103071d3ff5ebf3a2f22d40502f4bf29ba5bbe2342e5635d0017c198e89e698da703ee10b6089c6c45780
SSDEEP 768:HMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:HbIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 ed5568ec1db50e2dfa0d8d529617dd1e5c11be9dba8be13a892634ea7f484165
MD5 8bef028187462039bbfec8cafbb8ba62
SHA1 99e0117a4152de5160985ed6469dd9918b0d33ff
SHA512 87a8776235d122abe79d0274a9afa2b926910ecccb322bd8b65b44d94705739ab9d364e0df6ac7d62345ebf0cc4762b91ce87cfd63cc0c8d95927f6bf6f93bbd
SSDEEP 768:PMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:PbIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 92KB
SHA256 ff8f8355fd557344a10a43769eb944eb5d661ac3d227d17543b1a739ed0eaa4a
MD5 e4bae350b0a307275c88ac6b3b1fd408
SHA1 e89559c6bc6277b8cd4643080c16c740bdeede42
SHA512 5ff40c93c7bb54d51919a019d5e3d14e6da4b3a641574225ea477d83dc497bb3a145e447d1058e266b47c561cfd7781f5899f234ec43da57da985df7d8630ae9
SSDEEP 768:XMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:XbIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1440-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1440-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1440-11-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4448-18-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4448-20-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4684-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4684-5-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4916-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4916-17-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads