neconyd | 6a44f825e540efced1c8faf46c106ccb0f7fd314b12e7c5218dc50427c891bbc

Analysis

max time kernel
145s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42f5edc7a1687ec46c14310f40bf8cb0_NeikiAnalytics.exe
Size 72KB
Sample240519-btke2abb2t
SHA256 6a44f825e540efced1c8faf46c106ccb0f7fd314b12e7c5218dc50427c891bbc
MD5 42f5edc7a1687ec46c14310f40bf8cb0
SHA1 f50f9b3a4ba5c70a6fa93ccf1f433ea0ab0b2b90
SHA512 e2b9288fb6df44211a9375e92c5184725475a0f84cb8ea114dbf905b58302727d708e95412e0f96650fcef8b49f0923e67adbdadaa48ed341ce1e090de69cf7e
SSDEEP 768:5MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:5bIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2040	omsecor.exe
2356	omsecor.exe
1720	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2168	42f5edc7a1687ec46c14310f40bf8cb0_NeikiAnalytics.exe
2168	42f5edc7a1687ec46c14310f40bf8cb0_NeikiAnalytics.exe
2040	omsecor.exe
2040	omsecor.exe
2356	omsecor.exe
2356	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2040	2168	42f5edc7a1687ec46c14310f40bf8cb0_NeikiAnalytics.exe	28
PID 2168 wrote to memory of 2040	2168	42f5edc7a1687ec46c14310f40bf8cb0_NeikiAnalytics.exe	28
PID 2168 wrote to memory of 2040	2168	42f5edc7a1687ec46c14310f40bf8cb0_NeikiAnalytics.exe	28
PID 2168 wrote to memory of 2040	2168	42f5edc7a1687ec46c14310f40bf8cb0_NeikiAnalytics.exe	28
PID 2040 wrote to memory of 2356	2040	omsecor.exe	32
PID 2040 wrote to memory of 2356	2040	omsecor.exe	32
PID 2040 wrote to memory of 2356	2040	omsecor.exe	32
PID 2040 wrote to memory of 2356	2040	omsecor.exe	32
PID 2356 wrote to memory of 1720	2356	omsecor.exe	33
PID 2356 wrote to memory of 1720	2356	omsecor.exe	33
PID 2356 wrote to memory of 1720	2356	omsecor.exe	33
PID 2356 wrote to memory of 1720	2356	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\42f5edc7a1687ec46c14310f40bf8cb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\42f5edc7a1687ec46c14310f40bf8cb0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 5718480ef44ef77e4662c409110160275048a4db4f3af2bc7fe4e3f9da665d71
MD5 9bf0429fbf0455c569538003613509ba
SHA1 0b89a67f0bc15119a95b48f0bf1d208f5a7db958
SHA512 d252e54633599e3e6c86341372c62b920583f15f3646d698529884aadcc5594c4226d8a003edc186cebf9342a6fbe23c4efa05df57cfd29d3cd5ab2c293da73a
SSDEEP 768:zMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:zbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 225310febf2a129b8c7b2cecfae18ddc2d211d1770c86143eeb95871737f34c7
MD5 30b4be4d3166bd9b65e8286c7bfd194a
SHA1 2bc6294cb970aa03afe24dd3a4fdf0fb2a53eaeb
SHA512 b05f9adbe4c4d4a05e060b3dbff688e1644e5362b5d2884b4c9bac976c5b13c7169ec50eed336ce23678b8ff3aa8cb73cc66d6a90ef5d00d8ba19e006bb78876
SSDEEP 768:BMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:BbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 72KB
SHA256 acb6c8e7ff1ac1b62b8a298337eb573ac15a9a65a74ae38ae1e24a2a3e0e899c
MD5 d31ee0c539cde0274a1dab1515548c1e
SHA1 038f6a50155cfcf3b8d78ac40ddc3226a5c52029
SHA512 417e8e6e169d443c0ac2432fdd91ebeb2d5b655072aa392c96851059979d209c38f658900ba0ea96242829e1496781cf89edb6da25123e03e0c46755e69d13c1
SSDEEP 768:fMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:fbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads