neconyd | bf744d561f01a9aa7ea4005b68e2713f94f876953e07160ba1cef3f35716c2e6

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
55f17fa06a881352a0c80a6c604c8900_NeikiAnalytics.exe
Size 96KB
Sample240519-c1h18aeb68
SHA256 bf744d561f01a9aa7ea4005b68e2713f94f876953e07160ba1cef3f35716c2e6
MD5 55f17fa06a881352a0c80a6c604c8900
SHA1 de0d545426f3b3a8140836095eef530cce43ed3f
SHA512 28664e9baf0ef1318bdb127a06c8256ad6184d46dcc9d6b6d3e05ded2d380e000572d1eaf4083ba90b5fc57421fcaddf3c94e9fef81ed2e3f1dc19db1b125a2b
SSDEEP 1536:/nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:/Gs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
4232	omsecor.exe
4220	omsecor.exe
1624	omsecor.exe
1756	omsecor.exe
1768	omsecor.exe
2596	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4856 set thread context of 4876	4856	55f17fa06a881352a0c80a6c604c8900_NeikiAnalytics.exe	83
PID 4232 set thread context of 4220	4232	omsecor.exe	87
PID 1624 set thread context of 1756	1624	omsecor.exe	109
PID 1768 set thread context of 2596	1768	omsecor.exe	113

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1992	4856	WerFault.exe	82
3504	4232	WerFault.exe	85
1256	1624	WerFault.exe	108
3932	1768	WerFault.exe	111

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4876	4856	55f17fa06a881352a0c80a6c604c8900_NeikiAnalytics.exe	83
PID 4856 wrote to memory of 4876	4856	55f17fa06a881352a0c80a6c604c8900_NeikiAnalytics.exe	83
PID 4856 wrote to memory of 4876	4856	55f17fa06a881352a0c80a6c604c8900_NeikiAnalytics.exe	83
PID 4856 wrote to memory of 4876	4856	55f17fa06a881352a0c80a6c604c8900_NeikiAnalytics.exe	83
PID 4856 wrote to memory of 4876	4856	55f17fa06a881352a0c80a6c604c8900_NeikiAnalytics.exe	83
PID 4876 wrote to memory of 4232	4876	55f17fa06a881352a0c80a6c604c8900_NeikiAnalytics.exe	85
PID 4876 wrote to memory of 4232	4876	55f17fa06a881352a0c80a6c604c8900_NeikiAnalytics.exe	85
PID 4876 wrote to memory of 4232	4876	55f17fa06a881352a0c80a6c604c8900_NeikiAnalytics.exe	85
PID 4232 wrote to memory of 4220	4232	omsecor.exe	87
PID 4232 wrote to memory of 4220	4232	omsecor.exe	87
PID 4232 wrote to memory of 4220	4232	omsecor.exe	87
PID 4232 wrote to memory of 4220	4232	omsecor.exe	87
PID 4232 wrote to memory of 4220	4232	omsecor.exe	87
PID 4220 wrote to memory of 1624	4220	omsecor.exe	108
PID 4220 wrote to memory of 1624	4220	omsecor.exe	108
PID 4220 wrote to memory of 1624	4220	omsecor.exe	108
PID 1624 wrote to memory of 1756	1624	omsecor.exe	109
PID 1624 wrote to memory of 1756	1624	omsecor.exe	109
PID 1624 wrote to memory of 1756	1624	omsecor.exe	109
PID 1624 wrote to memory of 1756	1624	omsecor.exe	109
PID 1624 wrote to memory of 1756	1624	omsecor.exe	109
PID 1756 wrote to memory of 1768	1756	omsecor.exe	111
PID 1756 wrote to memory of 1768	1756	omsecor.exe	111
PID 1756 wrote to memory of 1768	1756	omsecor.exe	111
PID 1768 wrote to memory of 2596	1768	omsecor.exe	113
PID 1768 wrote to memory of 2596	1768	omsecor.exe	113
PID 1768 wrote to memory of 2596	1768	omsecor.exe	113
PID 1768 wrote to memory of 2596	1768	omsecor.exe	113
PID 1768 wrote to memory of 2596	1768	omsecor.exe	113

C:\Users\Admin\AppData\Local\Temp\55f17fa06a881352a0c80a6c604c8900_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\55f17fa06a881352a0c80a6c604c8900_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\55f17fa06a881352a0c80a6c604c8900_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\55f17fa06a881352a0c80a6c604c8900_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4220
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1624
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:2596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 256
        8⤵
        Program crash
        
        PID:3932
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 292
        6⤵
        Program crash
        
        PID:1256
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 292
      4⤵
      Program crash
      PID:3504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 288
  2⤵
  - Program crash
  PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4856 -ip 4856
1⤵
PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4232 -ip 4232
1⤵
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1624 -ip 1624
1⤵
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1768 -ip 1768
1⤵
PID:1212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 ec360c77a5cd1a0771e5e3197fb523225ff77d0225cd485f86086b24ecc6dbc8
MD5 8fce5bb3db0baea0d85942d553d10f50
SHA1 79401a8af9da72dcd0e8579c985746de62d85457
SHA512 0e3ecfe366dd430e4d39f5fb88c9920eab323f3e1416158cdcc90a6f9d9eeffd9d34d93c8c0575dbd6304224ae14844e9dfbbd3e8b595b1cdecfbe107595c9c6
SSDEEP 1536:nnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:nGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 4a480708795f6dcf7bf9ff3e6bbf8b604808bf09d4fb05762317f6026a673bfd
MD5 155e6e7bdf9d5a810d49f6e3d95c5989
SHA1 e728ac0f3cf03e46bec43f8c30a6b623d2d71aa2
SHA512 892ba5da29c4d0efeda1256e71f4aa548594a5413968962a4ea0b2d7180f8015027807b4c23a264df97249a50284446ad9f055b044bec0deded25eefdf2c3768
SSDEEP 1536:QnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:QGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 8299f60ceae76cab369d02a219faeae66389cec5ca6d0da2a6bd5c094ab5e6c6
MD5 e9f444599ded4f497bfdb0af6a8538ce
SHA1 f9104ae1505e5ff33259d55c2517308010805ac7
SHA512 4049d6018eb19c331cbf1170c3bd4f8c1af8edde2f17a8a66cb8188537b47e8b0257fa8bfcb430bf0013ecd640bd8ad40d5d86e2a91ac518f68f7ad750908f15
SSDEEP 1536:YnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:YGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1624-34-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1624-53-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1756-38-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1756-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1756-40-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1768-54-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1768-45-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2596-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2596-51-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2596-55-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2596-58-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4220-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4220-27-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4220-31-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4220-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4220-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4220-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4220-16-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4232-18-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4232-10-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4856-19-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4856-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4876-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4876-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4876-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4876-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads