neconyd | 4d01d4435e781a4e4894a14040e34fb7ec4597c41001b90c805bd724e1309939

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
90258b1e231fff1d9ccaea38fa7494a0_NeikiAnalytics.exe
Size 76KB
Sample240519-g6az1sec91
SHA256 4d01d4435e781a4e4894a14040e34fb7ec4597c41001b90c805bd724e1309939
MD5 90258b1e231fff1d9ccaea38fa7494a0
SHA1 09c4a7e883b76753759697d892041d679f1ed536
SHA512 23c442cff5fe06a784ca33aa4493a98eedd6bc0cb01eae6083e290de65df64ff69e2b628d00f521cee412866a5eef2384cb19e4440f92ebcb0e06bce4fc76c7d
SSDEEP 1536:ad9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:6dseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
3680	omsecor.exe
1108	omsecor.exe
1860	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 3680	4916	90258b1e231fff1d9ccaea38fa7494a0_NeikiAnalytics.exe	82
PID 4916 wrote to memory of 3680	4916	90258b1e231fff1d9ccaea38fa7494a0_NeikiAnalytics.exe	82
PID 4916 wrote to memory of 3680	4916	90258b1e231fff1d9ccaea38fa7494a0_NeikiAnalytics.exe	82
PID 3680 wrote to memory of 1108	3680	omsecor.exe	101
PID 3680 wrote to memory of 1108	3680	omsecor.exe	101
PID 3680 wrote to memory of 1108	3680	omsecor.exe	101
PID 1108 wrote to memory of 1860	1108	omsecor.exe	102
PID 1108 wrote to memory of 1860	1108	omsecor.exe	102
PID 1108 wrote to memory of 1860	1108	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\90258b1e231fff1d9ccaea38fa7494a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\90258b1e231fff1d9ccaea38fa7494a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 4887a5035e6470f2ca7cc3ae02178dc8c2b924390d1d04e165625f47dc3ad57d
MD5 8de70c801dcf0220e8ea1a14980abc2d
SHA1 2720afba62d81e8cdd739d1a6bbc1d6965f9706d
SHA512 92d18c46ffa870614632a35234cf14c4ae76b88ca0043430e86b7faa10b4ae13315fc7954a8044e71b899e9bd59ae9d343ab179b6b6233898381848a752a4ab4
SSDEEP 1536:Zd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:5dseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 4a2c726e5e208f3617f1df23be8cb074c32df2a76c78e3b78c225710ce8d4b33
MD5 b7d90df4f9abf1e5759d120efcef2358
SHA1 9df974744e76bd29e097031335bbd915690d78b7
SHA512 5ef030221012189dbe16c75f77bb8599e944e3264c32c8e67b0291c00b1ac90388f5d97674addafd97f05a68a81e589a9f3784d09eefd77fa08a7f11094e5786
SSDEEP 1536:Kd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:KdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 c61433b17f7bee3e3b48b5abd0669c36572562403e2602d1d3ba565d6060818a
MD5 418ca88fae684796d9970c94635dc85a
SHA1 b1f78ae21a8bd347d980e776b575248508c61d26
SHA512 8b896811bac64043d408ba14fd4de3ff736f380fc18d00d9cd65778432b451d5a9d625bcbbdfeef74ccada465b87f145bdfbcc57875e6deaebd2395f3a54c4ce
SSDEEP 1536:Nd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:ldseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1108-17-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1108-13-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1860-18-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1860-20-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3680-6-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3680-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3680-12-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4916-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4916-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads