neconyd | 05c107152aed792c2415298100e41670767bf23283d9db26404919f27345c407

Analysis

max time kernel
145s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
309e0a79fe57ed42b85efca63364b660_NeikiAnalytics.exe
Size 64KB
Sample240519-akpsqagc32
SHA256 05c107152aed792c2415298100e41670767bf23283d9db26404919f27345c407
MD5 309e0a79fe57ed42b85efca63364b660
SHA1 9bad447e8a91fc1e9f47217c4ed50b984c75c9ed
SHA512 efc3a4bd21108ed1921a627ad09ad467bcc77c0f99a83c94f0377c861fc647e03c7d90d60f60e1b4df19d4617fa4478c93083b8863940bbdf73f46f2a546c76c
SSDEEP 768:KMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:KbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2760	omsecor.exe
2684	omsecor.exe
1788	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2060	309e0a79fe57ed42b85efca63364b660_NeikiAnalytics.exe
2060	309e0a79fe57ed42b85efca63364b660_NeikiAnalytics.exe
2760	omsecor.exe
2760	omsecor.exe
2684	omsecor.exe
2684	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2760	2060	309e0a79fe57ed42b85efca63364b660_NeikiAnalytics.exe	28
PID 2060 wrote to memory of 2760	2060	309e0a79fe57ed42b85efca63364b660_NeikiAnalytics.exe	28
PID 2060 wrote to memory of 2760	2060	309e0a79fe57ed42b85efca63364b660_NeikiAnalytics.exe	28
PID 2060 wrote to memory of 2760	2060	309e0a79fe57ed42b85efca63364b660_NeikiAnalytics.exe	28
PID 2760 wrote to memory of 2684	2760	omsecor.exe	32
PID 2760 wrote to memory of 2684	2760	omsecor.exe	32
PID 2760 wrote to memory of 2684	2760	omsecor.exe	32
PID 2760 wrote to memory of 2684	2760	omsecor.exe	32
PID 2684 wrote to memory of 1788	2684	omsecor.exe	33
PID 2684 wrote to memory of 1788	2684	omsecor.exe	33
PID 2684 wrote to memory of 1788	2684	omsecor.exe	33
PID 2684 wrote to memory of 1788	2684	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\309e0a79fe57ed42b85efca63364b660_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\309e0a79fe57ed42b85efca63364b660_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 6cad8341894c56896eda8fa895e346cd5109728228069629392be938b587dd79
MD5 aa64b8659ed1408abcb4ae686bb28549
SHA1 a741733b3e0707c6b8c39629481b2db01fc150ac
SHA512 f45475c3143a1c5cd1e49ff8c13d3e550245feb924d0ab9a11af1c704349c26d58d7d2bb26046761b8bcff6b8e6c3ca413d8c4d38d61946f0c0b4abf9244d582
SSDEEP 768:+MEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:+bIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 ea5e6dbca17fb27443b1da6235ea074039f38bce13766172df1f48a7ccebd880
MD5 6f66d93c122bbc378db9672d30718460
SHA1 bbd869e98e67d87ef6332aed31c14b1163a58d54
SHA512 dccf87c5732e61e69e405987e484bb8616a288ae0b636a76c2214b9437ef46fdd28b2f531a6dda6da4570671a294dfdb2cd786254095f8a74985fd45abf3d458
SSDEEP 768:MMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:MbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 64KB
SHA256 1eb135f09a595bc2ec990ed00733c97b2adbb0a06e644e17d549d8a73adebfc7
MD5 5780bed029480f7c34459f9855038605
SHA1 bde8eca549d7b2029957d0ac9fa597a7b6d05a02
SHA512 90f84b5ab5d5093a9fd52d75a0ec98573d2ee23a19e2dfa62f6c662c2981d71fbb970734a5876c3ef040d11ef869c1302b5ea4e8e010d91949c40252c154d7fa
SSDEEP 768:sMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:sbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads