neconyd | 25f59c760a6c8427613a5a4e0bc01d06602e84805573648e6bd8b92af8cc8ea3

Analysis

max time kernel
146s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7670120d32f2d5f23fe3dab59f2270d0_NeikiAnalytics.exe
Size 89KB
Sample240519-fbqljsah3y
SHA256 25f59c760a6c8427613a5a4e0bc01d06602e84805573648e6bd8b92af8cc8ea3
MD5 7670120d32f2d5f23fe3dab59f2270d0
SHA1 13f8c34f3453c6b246d73c9f25e34afa1b95829d
SHA512 7188c203969e0f1d2d853c2e800e9e6d32e674f1fbc73b47977730a1a5be2ea8c163a4938b1ea230eb183690bde85b703d83c45249518179db9420460576ea15
SSDEEP 768:2MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:2bIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2688	omsecor.exe
1912	omsecor.exe
2160	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1952	7670120d32f2d5f23fe3dab59f2270d0_NeikiAnalytics.exe
1952	7670120d32f2d5f23fe3dab59f2270d0_NeikiAnalytics.exe
2688	omsecor.exe
2688	omsecor.exe
1912	omsecor.exe
1912	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2688	1952	7670120d32f2d5f23fe3dab59f2270d0_NeikiAnalytics.exe	28
PID 1952 wrote to memory of 2688	1952	7670120d32f2d5f23fe3dab59f2270d0_NeikiAnalytics.exe	28
PID 1952 wrote to memory of 2688	1952	7670120d32f2d5f23fe3dab59f2270d0_NeikiAnalytics.exe	28
PID 1952 wrote to memory of 2688	1952	7670120d32f2d5f23fe3dab59f2270d0_NeikiAnalytics.exe	28
PID 2688 wrote to memory of 1912	2688	omsecor.exe	32
PID 2688 wrote to memory of 1912	2688	omsecor.exe	32
PID 2688 wrote to memory of 1912	2688	omsecor.exe	32
PID 2688 wrote to memory of 1912	2688	omsecor.exe	32
PID 1912 wrote to memory of 2160	1912	omsecor.exe	33
PID 1912 wrote to memory of 2160	1912	omsecor.exe	33
PID 1912 wrote to memory of 2160	1912	omsecor.exe	33
PID 1912 wrote to memory of 2160	1912	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\7670120d32f2d5f23fe3dab59f2270d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7670120d32f2d5f23fe3dab59f2270d0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 89KB
SHA256 cec1dac61c464a1179eeb1277eaa1855cd0f53c75d4c71052908bd67f389146e
MD5 d98af346731c2180ad64ba3c15191f82
SHA1 146cf7b9bb77fb3ee53c11db3f7e5996e2d1a6d6
SHA512 9d353860231b04ed38f63766d3575b1c2e5c65aba3d8635eb83fbe13cd2ee1318603dea71c842d933aa09e1f801157642a9a42ec1643ef4c4ba029730a644ccc
SSDEEP 768:KMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:KbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 89KB
SHA256 4607b93792785464a4bd0d360a4b011c71879f9bfac8283c1b99afabae941000
MD5 d4aef3091fc4b806e4aafce89d505b51
SHA1 04afb1e29c592abcfd2fd33f7a2a9b21a1330400
SHA512 2788946180437ddc1549e65cb25b43a5f37ff22e117e80e1e3faa26021ae7a44fa4813389b69659428e9afcb459ce9b2ce7ae083752ef8d80fe467406a2ef1ea
SSDEEP 768:7MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:7bIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 89KB
SHA256 432a8632af8ceedd70a6af245f493bfc6124c4a572067b4dc47ba74d6863320a
MD5 0199ada22aebf31d2bdf03d6b1984ad8
SHA1 da6d297ca50e179659b98db48c3259b461155f23
SHA512 44bae38cd0f9fa93dbb78766ab6e4d7ba0ac347385cc5693fe2b074b8394a81cfa34d3900166f9e329d3985207c5f84fc771cb3b7b5d9f9cfe59380e25a95459
SSDEEP 768:TMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:TbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads