neconyd | 6a44f825e540efced1c8faf46c106ccb0f7fd314b12e7c5218dc50427c891bbc

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42f5edc7a1687ec46c14310f40bf8cb0_NeikiAnalytics.exe
Size 72KB
Sample240519-btke2abb2t
SHA256 6a44f825e540efced1c8faf46c106ccb0f7fd314b12e7c5218dc50427c891bbc
MD5 42f5edc7a1687ec46c14310f40bf8cb0
SHA1 f50f9b3a4ba5c70a6fa93ccf1f433ea0ab0b2b90
SHA512 e2b9288fb6df44211a9375e92c5184725475a0f84cb8ea114dbf905b58302727d708e95412e0f96650fcef8b49f0923e67adbdadaa48ed341ce1e090de69cf7e
SSDEEP 768:5MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:5bIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4856	omsecor.exe
3152	omsecor.exe
2904	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4856	4892	42f5edc7a1687ec46c14310f40bf8cb0_NeikiAnalytics.exe	83
PID 4892 wrote to memory of 4856	4892	42f5edc7a1687ec46c14310f40bf8cb0_NeikiAnalytics.exe	83
PID 4892 wrote to memory of 4856	4892	42f5edc7a1687ec46c14310f40bf8cb0_NeikiAnalytics.exe	83
PID 4856 wrote to memory of 3152	4856	omsecor.exe	101
PID 4856 wrote to memory of 3152	4856	omsecor.exe	101
PID 4856 wrote to memory of 3152	4856	omsecor.exe	101
PID 3152 wrote to memory of 2904	3152	omsecor.exe	102
PID 3152 wrote to memory of 2904	3152	omsecor.exe	102
PID 3152 wrote to memory of 2904	3152	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\42f5edc7a1687ec46c14310f40bf8cb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\42f5edc7a1687ec46c14310f40bf8cb0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 d36477eef8c97ca2899ce54250cf8dccca6b04e776457de977a47ea3fd9b820a
MD5 60205cfd71d4dce6b9387e499ed8d897
SHA1 5594288cfdc64e73447854f039aac95331ec1b04
SHA512 4d9f629a8fd91a8bb3c42cc6d991ea1412d14558bb871ae00dc08a1364473ce953d3d5cc5339d27cd1defd897db4ed049dd63af993745d5f27d6b300219825b0
SSDEEP 768:jQMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:cbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 225310febf2a129b8c7b2cecfae18ddc2d211d1770c86143eeb95871737f34c7
MD5 30b4be4d3166bd9b65e8286c7bfd194a
SHA1 2bc6294cb970aa03afe24dd3a4fdf0fb2a53eaeb
SHA512 b05f9adbe4c4d4a05e060b3dbff688e1644e5362b5d2884b4c9bac976c5b13c7169ec50eed336ce23678b8ff3aa8cb73cc66d6a90ef5d00d8ba19e006bb78876
SSDEEP 768:BMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:BbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 72KB
SHA256 2eed8c53af5dc7a207233a93cafee7449d1b7396e7c0505df32bcc0a3aae64af
MD5 29007e8922f0d89b80530b57287df63b
SHA1 452911f2efbc38c833cb1c3eceb44e2d687bb40f
SHA512 6e4d225593c26c7d260821e7506f58f7ff0a0f6fa8fd2148099cf996acae0f9e2e0b1f1165440e806b1ba37ff95918ff1a85a3a8613c25e8c15abf2eefc0d818
SSDEEP 768:QMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:QbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads