neconyd | 6d6031da4a951bf1b08c7a88ce5a76f99480e183115be8a19c099576fa6ccb9f

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
759e87a6927cb5a79fd504eaa8f0f540_NeikiAnalytics.exe
Size 72KB
Sample240519-e9k82sag3y
SHA256 6d6031da4a951bf1b08c7a88ce5a76f99480e183115be8a19c099576fa6ccb9f
MD5 759e87a6927cb5a79fd504eaa8f0f540
SHA1 0fc5fd84f0690ac62af2831e2a8f7f909d500da3
SHA512 8941f4960ba8085a2257f41af278a9d092a19189248adf50dffb536ed992505dc26321b2a3478b02ceeecc48d5911ee6f7ae59732422106368cd9e74dce3777d
SSDEEP 768:hMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:hbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4952	omsecor.exe
3248	omsecor.exe
952	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 4952	3164	759e87a6927cb5a79fd504eaa8f0f540_NeikiAnalytics.exe	82
PID 3164 wrote to memory of 4952	3164	759e87a6927cb5a79fd504eaa8f0f540_NeikiAnalytics.exe	82
PID 3164 wrote to memory of 4952	3164	759e87a6927cb5a79fd504eaa8f0f540_NeikiAnalytics.exe	82
PID 4952 wrote to memory of 3248	4952	omsecor.exe	99
PID 4952 wrote to memory of 3248	4952	omsecor.exe	99
PID 4952 wrote to memory of 3248	4952	omsecor.exe	99

C:\Users\Admin\AppData\Local\Temp\759e87a6927cb5a79fd504eaa8f0f540_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\759e87a6927cb5a79fd504eaa8f0f540_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    PID:3248
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 729ddfdaeae6d1c835a9647093f50235efbb241e1f341416fbfaad4ee6c47e12
MD5 1676e059d6f41f2f59b001a5778ee1fe
SHA1 0cc6711157cafa362a21c0a53f4893886f9d2b5e
SHA512 9e08bf7aee5499b52b5f58199364cfbad402942711b9dd5e3fc4abe30dfc91172ff314363779e33cff2de67c6b446290890cf4fe8e72db3bca71fd8b2d5e5ed7
SSDEEP 768:pMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:pbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 3acc7631632aa2159a1d2b7f07612568779f569db65589f13b4bfa138e0b82f2
MD5 7beabe0ce1bb216227fda01fc61ca6ba
SHA1 b0fab20034786baa68da59e94bc62caa343186f2
SHA512 4d91937b8c74e3ed829b42e1964208e1b392c86117d51758635a9792e4b27f136f73f5557e20e6462bf1a43c5c00f8a6104704d51fed933c4c120dd0c3ea39b1
SSDEEP 768:YMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:YbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 72KB
SHA256 48444a0a84ece742125e58ea7bf8197a12439aaec6b62fa6d20433fa8b71e3e2
MD5 f645d822984c601a646068b7da734a8a
SHA1 a620b8c290635751924587b6e96b4b84c043c67d
SHA512 0dc93a6fc8b6e89eb2195403ad39867b4b2fc3c280d9999586ef69d0a8effab6bfb88663c585fc5d9035c4bec7e8f3bd65fcdc2aa8655a5a49eee907db510046
SSDEEP 768:8MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:8bIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads