neconyd | 01f83c2363eea73fd53d4880fb4969cbd7ada97b69c59f301869d45d3a8db52f

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 01:53

Target
4bf60b7e717b801252dc4afe3e199c30_NeikiAnalytics.exe
Size 64KB
Sample240519-ca3myacd4w
SHA256 01f83c2363eea73fd53d4880fb4969cbd7ada97b69c59f301869d45d3a8db52f
MD5 4bf60b7e717b801252dc4afe3e199c30
SHA1 0665a486585547a0d1f8b40c16a872a45df826b5
SHA512 45870ee09f206d2e47313bd34b8bc563c444d320d8c43957f757c03214295f06fe59a10f95b403aaab5e17b02bb2f2ea8cf23671999a0d4ad0fce2164c6e46b5
SSDEEP 768:wMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:wbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
212	omsecor.exe
1424	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 212	5000	4bf60b7e717b801252dc4afe3e199c30_NeikiAnalytics.exe	83
PID 5000 wrote to memory of 212	5000	4bf60b7e717b801252dc4afe3e199c30_NeikiAnalytics.exe	83
PID 5000 wrote to memory of 212	5000	4bf60b7e717b801252dc4afe3e199c30_NeikiAnalytics.exe	83
PID 212 wrote to memory of 1424	212	omsecor.exe	99
PID 212 wrote to memory of 1424	212	omsecor.exe	99
PID 212 wrote to memory of 1424	212	omsecor.exe	99

C:\Users\Admin\AppData\Local\Temp\4bf60b7e717b801252dc4afe3e199c30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4bf60b7e717b801252dc4afe3e199c30_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:1424

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 273c7ad49f56f4bd2038e77efa1dedb14eadcfb6231fabd432f31612a47c5ef3
MD5 35bbd70fd9287151f55bef74a22817c2
SHA1 8a7f4cc206510767398f44535f0fd7f7bd38a060
SHA512 dc0372608e3663cb96222870308e1afc6fc826c7833b0ed3e69de34e77f5e2426c28d27f24df379890845c9d8ae1e625815b1f6cd43a911f90d92fbae1e1f85f
SSDEEP 768:vMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:vbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 64KB
SHA256 e728ec67b87e9271b4caea915e0581474edf240adf4455c3db0b39063fc0d5b4
MD5 72f893405b8fc21f401928e8be6a911f
SHA1 1e6683373ffe63a8e5d292088a2fd0eb064ec443
SHA512 88894a3bcc03adc7a971d5a5ed50d0801fce17c73b5fc1fdef0331a3896feede249134e93bb0f88cb9496280abe6883b864e643aa5cec7a95d650aba9efd1eb9
SSDEEP 768:UMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:UbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download