neconyd | 023c8e333f085534bc0d0bc11585d87e866e68a573bf63542faf06352e6ec681

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1e916d693fe6f87f9f6d34f4c05f6880_NeikiAnalytics.exe
Size 96KB
Sample240518-v7temsfc94
SHA256 023c8e333f085534bc0d0bc11585d87e866e68a573bf63542faf06352e6ec681
MD5 1e916d693fe6f87f9f6d34f4c05f6880
SHA1 9ac6417ac01b0ef7e887cc50722d5a675080204f
SHA512 58f754145f640142a9d55fb5483696e2d458ef62f9cd2e1e9b8cbbda618116f34600bb4fe63f08e8e3898faeb9988a7cb089fd58baffe0dc12aaaebf2d9e31d3
SSDEEP 1536:MnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:MGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
4864	omsecor.exe
3516	omsecor.exe
3316	omsecor.exe
4992	omsecor.exe
2996	omsecor.exe
684	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4832 set thread context of 4056	4832	1e916d693fe6f87f9f6d34f4c05f6880_NeikiAnalytics.exe	91
PID 4864 set thread context of 3516	4864	omsecor.exe	95
PID 3316 set thread context of 4992	3316	omsecor.exe	109
PID 2996 set thread context of 684	2996	omsecor.exe	113

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4700	4864	WerFault.exe	94
3132	4832	WerFault.exe	90
4276	3316	WerFault.exe	108
880	2996	WerFault.exe	112

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4056	4832	1e916d693fe6f87f9f6d34f4c05f6880_NeikiAnalytics.exe	91
PID 4832 wrote to memory of 4056	4832	1e916d693fe6f87f9f6d34f4c05f6880_NeikiAnalytics.exe	91
PID 4832 wrote to memory of 4056	4832	1e916d693fe6f87f9f6d34f4c05f6880_NeikiAnalytics.exe	91
PID 4832 wrote to memory of 4056	4832	1e916d693fe6f87f9f6d34f4c05f6880_NeikiAnalytics.exe	91
PID 4832 wrote to memory of 4056	4832	1e916d693fe6f87f9f6d34f4c05f6880_NeikiAnalytics.exe	91
PID 4056 wrote to memory of 4864	4056	1e916d693fe6f87f9f6d34f4c05f6880_NeikiAnalytics.exe	94
PID 4056 wrote to memory of 4864	4056	1e916d693fe6f87f9f6d34f4c05f6880_NeikiAnalytics.exe	94
PID 4056 wrote to memory of 4864	4056	1e916d693fe6f87f9f6d34f4c05f6880_NeikiAnalytics.exe	94
PID 4864 wrote to memory of 3516	4864	omsecor.exe	95
PID 4864 wrote to memory of 3516	4864	omsecor.exe	95
PID 4864 wrote to memory of 3516	4864	omsecor.exe	95
PID 4864 wrote to memory of 3516	4864	omsecor.exe	95
PID 4864 wrote to memory of 3516	4864	omsecor.exe	95
PID 3516 wrote to memory of 3316	3516	omsecor.exe	108
PID 3516 wrote to memory of 3316	3516	omsecor.exe	108
PID 3516 wrote to memory of 3316	3516	omsecor.exe	108
PID 3316 wrote to memory of 4992	3316	omsecor.exe	109
PID 3316 wrote to memory of 4992	3316	omsecor.exe	109
PID 3316 wrote to memory of 4992	3316	omsecor.exe	109
PID 3316 wrote to memory of 4992	3316	omsecor.exe	109
PID 3316 wrote to memory of 4992	3316	omsecor.exe	109
PID 4992 wrote to memory of 2996	4992	omsecor.exe	112
PID 4992 wrote to memory of 2996	4992	omsecor.exe	112
PID 4992 wrote to memory of 2996	4992	omsecor.exe	112
PID 2996 wrote to memory of 684	2996	omsecor.exe	113
PID 2996 wrote to memory of 684	2996	omsecor.exe	113
PID 2996 wrote to memory of 684	2996	omsecor.exe	113
PID 2996 wrote to memory of 684	2996	omsecor.exe	113
PID 2996 wrote to memory of 684	2996	omsecor.exe	113

C:\Users\Admin\AppData\Local\Temp\1e916d693fe6f87f9f6d34f4c05f6880_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1e916d693fe6f87f9f6d34f4c05f6880_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\1e916d693fe6f87f9f6d34f4c05f6880_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\1e916d693fe6f87f9f6d34f4c05f6880_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3516
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3316
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 260
        8⤵
        Program crash
        
        PID:880
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 292
        6⤵
        Program crash
        
        PID:4276
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 300
      4⤵
      Program crash
      PID:4700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 292
  2⤵
  - Program crash
  PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4832 -ip 4832
1⤵
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4864 -ip 4864
1⤵
PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3816 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3316 -ip 3316
1⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2996 -ip 2996
1⤵
PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 9351f778a72bb38247d31fd5f17ec550987f806459869587d8d4b8bb64d2da8e
MD5 af5c0273688945a415c07d18e03444ca
SHA1 273fa8a93c88f88278a0026a8be3bb79f619540c
SHA512 32ea3d3ee4f839ae250ff785f058120f9259a27fbc191e64b533c1c517f533ac2414aedbc342ec37cc40091f5d912645475838259a2435ee5964f8082e730e3b
SSDEEP 1536:tnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:tGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 d69fdf6662439f75d5337b860a23df17a6b87f77b23b6e0afcf1d6f50866ba67
MD5 2427c5d6abc6c4d18d5ab0f5d2815f4a
SHA1 91dec969466adf62b0586d6b949f38b18ae4c8f2
SHA512 f8a1d5626a548cdbc60070b3b5fc8438a7cac067dc9b3d044c54f69e930c1a5e646df2272b4fbf44f8652befa85cfa193ce94351da6f33c4401a9bba5f9c5393
SSDEEP 1536:AnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:AGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 e0135c262b746254121d2481a9e0d9c749c072d67d4eecdfcc44020a9240c74f
MD5 344f19835f72b241307756b1d353962c
SHA1 b2c3c8e68fd2c299f18357b8243940c9fea75ad1
SHA512 ce3a53c09e6282f2c747ce312ae7e7f0de9d18386f16619cd33d3d56e7513c4be93faf1c0b1015a3219df0cac2b831671e028667973a6124ed3f8a8a72255509
SSDEEP 1536:VnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:VGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/684-55-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/684-53-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/684-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/684-47-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2996-50-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2996-43-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3316-52-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3316-30-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3516-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3516-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3516-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3516-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3516-29-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3516-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3516-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4056-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4056-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4056-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4056-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4832-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4832-17-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4864-16-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4864-8-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4992-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4992-38-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4992-35-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads