neconyd | 79c19e633ee026a307a057191f7f0c878aa39382dd0ca0ca42eecbe60a5413a0

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c72cf7dfd5c3bcbee9d19e9a8fd4ecb0_NeikiAnalytics.exe
Size 76KB
Sample240518-p3llcacd36
SHA256 79c19e633ee026a307a057191f7f0c878aa39382dd0ca0ca42eecbe60a5413a0
MD5 c72cf7dfd5c3bcbee9d19e9a8fd4ecb0
SHA1 f1ed5add77a6e1ad838d5419567454f3b762fab4
SHA512 45d99362d4e94cd45b57c0385c11dd0bfb2b8f1a15de0bd043c0ab1b2f910bb4b021b03c16ebac7819a8d17f5741703e6df9feec43e874e6914072eba3fd44c7
SSDEEP 1536:ld9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:NdseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
3712	omsecor.exe
3952	omsecor.exe
3176	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 3712	4304	c72cf7dfd5c3bcbee9d19e9a8fd4ecb0_NeikiAnalytics.exe	83
PID 4304 wrote to memory of 3712	4304	c72cf7dfd5c3bcbee9d19e9a8fd4ecb0_NeikiAnalytics.exe	83
PID 4304 wrote to memory of 3712	4304	c72cf7dfd5c3bcbee9d19e9a8fd4ecb0_NeikiAnalytics.exe	83
PID 3712 wrote to memory of 3952	3712	omsecor.exe	100
PID 3712 wrote to memory of 3952	3712	omsecor.exe	100
PID 3712 wrote to memory of 3952	3712	omsecor.exe	100
PID 3952 wrote to memory of 3176	3952	omsecor.exe	101
PID 3952 wrote to memory of 3176	3952	omsecor.exe	101
PID 3952 wrote to memory of 3176	3952	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\c72cf7dfd5c3bcbee9d19e9a8fd4ecb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c72cf7dfd5c3bcbee9d19e9a8fd4ecb0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 ce84920b5194aa5dd95618deb5ce36b44305c67ffb1cd16d2abd83a35113e1ca
MD5 153bd9ea4d36bc4b2675947836b249f5
SHA1 250dd1d2d8a574a074c675c95ec2eac24169f957
SHA512 cb5d82000aaa5dacf856386b9eb0cd51b0eee331e17db002846103cd3ebfa1957a7d09791f85b548475b690e28cf9715075e000848ca68c2f550dac8b46d8773
SSDEEP 1536:Wd9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:udseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 bb6a45a0f4af6523a5ae6d77c79fe959b331d52e3db249374accc3c7dddaa0f2
MD5 38f0c81484715ec004ce710d209090fe
SHA1 03c66d2332f7bc447d5c354a605c2ca3cf6d6706
SHA512 e14f8c49cce396834df3db70bb25a5ccf82c636dd840f3c9151da3ef6ebef1660109c4546aa23e5654910b2291abeb3ec9f7106b72afabf44e3c683a4e31ef42
SSDEEP 1536:Jd9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:JdseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 90eae4d623c56ceb8854d4feb5d457e16f1f662717b841c5a3ca7747e137119a
MD5 eb815280bca0851db7f267cd640b5949
SHA1 068bf5e550525e285d19def380ef9506e3acbb90
SHA512 a842bb9817fdad47337f524c835519c275ba210c32e8dcbae66533ce355391cadbbf7252f2277324afba03e8e09a2a9713616814f1a4631bb2575a4e745d7c13
SSDEEP 1536:Od9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:WdseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3176-18-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3176-20-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3712-6-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3712-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3712-11-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3952-13-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3952-17-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4304-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4304-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads