neconyd | 15d4e7e3fd53954a73b7a9af652fca3e30775087e63787308133e8770b1c061c

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
760f5cd521d97481d7ea41b3c16c0b00_NeikiAnalytics.exe
Size 76KB
Sample240519-fal7qsah87
SHA256 15d4e7e3fd53954a73b7a9af652fca3e30775087e63787308133e8770b1c061c
MD5 760f5cd521d97481d7ea41b3c16c0b00
SHA1 a45f436587893fb2e176aac413efcc8305f069b5
SHA512 5cd321c0f4269ce79051c6c4b09b0ea849cfa641dd6913f368c7c944f1ca0e69ad0a6f25125fdf7bfba2feb0f9f46948b0bbb122f3b893128241b168ee9903f2
SSDEEP 768:fMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:fbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4444	omsecor.exe
4732	omsecor.exe
1852	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 4444	1164	760f5cd521d97481d7ea41b3c16c0b00_NeikiAnalytics.exe	83
PID 1164 wrote to memory of 4444	1164	760f5cd521d97481d7ea41b3c16c0b00_NeikiAnalytics.exe	83
PID 1164 wrote to memory of 4444	1164	760f5cd521d97481d7ea41b3c16c0b00_NeikiAnalytics.exe	83
PID 4444 wrote to memory of 4732	4444	omsecor.exe	99
PID 4444 wrote to memory of 4732	4444	omsecor.exe	99
PID 4444 wrote to memory of 4732	4444	omsecor.exe	99
PID 4732 wrote to memory of 1852	4732	omsecor.exe	100
PID 4732 wrote to memory of 1852	4732	omsecor.exe	100
PID 4732 wrote to memory of 1852	4732	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\760f5cd521d97481d7ea41b3c16c0b00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\760f5cd521d97481d7ea41b3c16c0b00_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 6c94ebc790443da884837562074dc71dab523f3547e29718bc8078037a67b74f
MD5 30abaf0ae24940eaee5f36826e3235f4
SHA1 5396d792b00e64c124d85580ee598f4aad231293
SHA512 96a46c48432cac349a237e22245a1ddf900b95f6232e3232790aaf565bb7b1a41cf3c92ab0fd2aabb7ac8d6f7c786508de12aa9cd3af75909b8a1c016a72326a
SSDEEP 768:5MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:5bIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 41a421ea3887ca0483323fbc554582029bfe1bc907e99a248efd0ab969839243
MD5 2c1a777042dc86df258075fb99b5e500
SHA1 9ab767a1fbeb91c8777eba9dfc5bdc775e71d2c9
SHA512 64553f69041328e32f68c42dca5bb03a0d4a7f65c078ef3a8be685fe097f44f78d927688237e881277db71ddf626990862f106cc0afda294486f70911a321bad
SSDEEP 768:TMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:TbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 bb18efebea7ef2a50e6e2b4d56e1c9e93e45f05bcc51ae3117392dc3dab965e0
MD5 98a5a46a99d4563a6128d0ad39c66cad
SHA1 d4fa31452a3b5279b4bcbad13f09cb40bf83558f
SHA512 15478a26bb73fec93ebdf2017347e4c819c88727d4cce187bd0156c7c18ec3f43e5b719c524debe406f9e5bad8adb852f392a5d1a868064585bfc519cd56db4f
SSDEEP 768:ZMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:ZbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads