neconyd | 1cf2cc11557e3ed20fe4d55dbb66b1e5b556b16c0888eff36109e97bd5cc8955

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
57208696a587a11ed80495bc60885bb0_NeikiAnalytics.exe
Size 76KB
Sample240519-c42yhaeb7v
SHA256 1cf2cc11557e3ed20fe4d55dbb66b1e5b556b16c0888eff36109e97bd5cc8955
MD5 57208696a587a11ed80495bc60885bb0
SHA1 7c4dd04abe23a43a742aa6b438cf885c2edad4d9
SHA512 6914894ed1d07f9b24468995658dce74cc47a3b6596e6b631550de6d3bf73cb046191516b6c9ddc0f719bc2149cc826e59dbd9452b704166f87c5b56ea0286f4
SSDEEP 1536:Xd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:fdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1352	omsecor.exe
2160	omsecor.exe
3464	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 1352	928	57208696a587a11ed80495bc60885bb0_NeikiAnalytics.exe	82
PID 928 wrote to memory of 1352	928	57208696a587a11ed80495bc60885bb0_NeikiAnalytics.exe	82
PID 928 wrote to memory of 1352	928	57208696a587a11ed80495bc60885bb0_NeikiAnalytics.exe	82
PID 1352 wrote to memory of 2160	1352	omsecor.exe	91
PID 1352 wrote to memory of 2160	1352	omsecor.exe	91
PID 1352 wrote to memory of 2160	1352	omsecor.exe	91
PID 2160 wrote to memory of 3464	2160	omsecor.exe	92
PID 2160 wrote to memory of 3464	2160	omsecor.exe	92
PID 2160 wrote to memory of 3464	2160	omsecor.exe	92

C:\Users\Admin\AppData\Local\Temp\57208696a587a11ed80495bc60885bb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\57208696a587a11ed80495bc60885bb0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 10247fc5664a2358d9b69b1a147e593d476ba14857d666bd8cde94cfd35ab87c
MD5 7865428cd4aca0a45339b576542701d1
SHA1 8c6effe3565be56c21da295c720f6f35795a19bb
SHA512 2b01a71336c28e15454575634e0e28b1751eeffcc589d21c19cdfd6c56e969cbfeef2e7b31ca193603e1ae03f15354d5566a3c85659906a197ecabafa8f111e5
SSDEEP 1536:Qd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:QdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 9abb5e57df5754f5392fdc97b8a066e99ab5947ab7cc44f909b59b904af2de0d
MD5 2aaac3de468ab558868c431474a67870
SHA1 8ac20e73ea3d6872fe5de41836671e4f0a43fd3d
SHA512 8c8bf80f28f63dfbebadd7081335c2e090ef9da1f9fc25872892ec65264f318bbf8e3d647d0b925fd31d5ab6fb770942e882646cb0131d86305ff2434f5e1146
SSDEEP 1536:/d9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:3dseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 c4b5f7edf63ca4aa06a99799c7853957e6d483db137e446b520e22ade1eaf335
MD5 5f853369177a3d33567fe4ae829454ea
SHA1 79559899046a9e33853601a583d88869b390ea99
SHA512 e71793fcec762b685d3ea2ae0eef3fdef7556f076912f90d366e3bbaa67f635728d7668750efed3d97e8d462e76c2f3877220762157853403a10593709952c3d
SSDEEP 1536:0d9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:MdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/928-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/928-6-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1352-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1352-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1352-11-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2160-13-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2160-17-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3464-18-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3464-20-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads