neconyd | 25f59c760a6c8427613a5a4e0bc01d06602e84805573648e6bd8b92af8cc8ea3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7670120d32f2d5f23fe3dab59f2270d0_NeikiAnalytics.exe
Size 89KB
Sample240519-fbqljsah3y
SHA256 25f59c760a6c8427613a5a4e0bc01d06602e84805573648e6bd8b92af8cc8ea3
MD5 7670120d32f2d5f23fe3dab59f2270d0
SHA1 13f8c34f3453c6b246d73c9f25e34afa1b95829d
SHA512 7188c203969e0f1d2d853c2e800e9e6d32e674f1fbc73b47977730a1a5be2ea8c163a4938b1ea230eb183690bde85b703d83c45249518179db9420460576ea15
SSDEEP 768:2MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:2bIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4756	omsecor.exe
2972	omsecor.exe
1916	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 4756	4228	7670120d32f2d5f23fe3dab59f2270d0_NeikiAnalytics.exe	83
PID 4228 wrote to memory of 4756	4228	7670120d32f2d5f23fe3dab59f2270d0_NeikiAnalytics.exe	83
PID 4228 wrote to memory of 4756	4228	7670120d32f2d5f23fe3dab59f2270d0_NeikiAnalytics.exe	83
PID 4756 wrote to memory of 2972	4756	omsecor.exe	100
PID 4756 wrote to memory of 2972	4756	omsecor.exe	100
PID 4756 wrote to memory of 2972	4756	omsecor.exe	100
PID 2972 wrote to memory of 1916	2972	omsecor.exe	101
PID 2972 wrote to memory of 1916	2972	omsecor.exe	101
PID 2972 wrote to memory of 1916	2972	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\7670120d32f2d5f23fe3dab59f2270d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7670120d32f2d5f23fe3dab59f2270d0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 89KB
SHA256 6482ed2e31a49f3307fd0e6deabe940cff8fe7cbec079fb78a37fd3f85d35e71
MD5 2dc0f3996a8925aa7839436cdaa83ffd
SHA1 fc9464baaecef2b4f35a51e02623658589a674be
SHA512 3a336b2e0806a336b6fbc46badd4a22c413c73af74d35be9953e73ec6be18c7925d2752b75359466e560fba8cbbc5b4b09e952bf8f8c2b3a69d34c84eb53b063
SSDEEP 768:NMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:NbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 89KB
SHA256 cec1dac61c464a1179eeb1277eaa1855cd0f53c75d4c71052908bd67f389146e
MD5 d98af346731c2180ad64ba3c15191f82
SHA1 146cf7b9bb77fb3ee53c11db3f7e5996e2d1a6d6
SHA512 9d353860231b04ed38f63766d3575b1c2e5c65aba3d8635eb83fbe13cd2ee1318603dea71c842d933aa09e1f801157642a9a42ec1643ef4c4ba029730a644ccc
SSDEEP 768:KMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:KbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 89KB
SHA256 c8a3e65fccba627c69f304bc56f2822a324dc4b704ad0a19e9b2accf3182b54b
MD5 991abb7499d4010b8e5443bc56c9a7a7
SHA1 02a03b769404a85089a62362256320a4799abadb
SHA512 4b6c05de894b0ed50bc23cce8d8535ec83d992e61c739accb09cbc86f750ea46dc8833a0b894be954193339c478aa7a4bde1df79b231d0d32c32a68b9abe8e6f
SSDEEP 768:hMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:hbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads