neconyd | 3b3052e8309f4692c8725ae45533de8fe5b95039f73666f0db194a54e423e0bc

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a937b12034943b8964887060a42c5970_NeikiAnalytics.exe
Size 96KB
Sample240519-j2xdkaaa2v
SHA256 3b3052e8309f4692c8725ae45533de8fe5b95039f73666f0db194a54e423e0bc
MD5 a937b12034943b8964887060a42c5970
SHA1 f74a6e9ee5450f859deeb18da8e9a81c3c89fd2f
SHA512 a6114c777c5c2b1f7d192edd184b3ea627bd98d9b326dc75edb00e42ae929918e0ed90424ed541adac90abc2f0b8bb01b63fc3e0fb1ba361763281f2da9783eb
SSDEEP 1536:TnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:TGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
3732	omsecor.exe
3320	omsecor.exe
2592	omsecor.exe
4688	omsecor.exe
4364	omsecor.exe
1220	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2452 set thread context of 3040	2452	a937b12034943b8964887060a42c5970_NeikiAnalytics.exe	82
PID 3732 set thread context of 3320	3732	omsecor.exe	87
PID 2592 set thread context of 4688	2592	omsecor.exe	105
PID 4364 set thread context of 1220	4364	omsecor.exe	109

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2592	2452	WerFault.exe	81
3868	3732	WerFault.exe	84
4400	2592	WerFault.exe	104
2408	4364	WerFault.exe	107

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 3040	2452	a937b12034943b8964887060a42c5970_NeikiAnalytics.exe	82
PID 2452 wrote to memory of 3040	2452	a937b12034943b8964887060a42c5970_NeikiAnalytics.exe	82
PID 2452 wrote to memory of 3040	2452	a937b12034943b8964887060a42c5970_NeikiAnalytics.exe	82
PID 2452 wrote to memory of 3040	2452	a937b12034943b8964887060a42c5970_NeikiAnalytics.exe	82
PID 2452 wrote to memory of 3040	2452	a937b12034943b8964887060a42c5970_NeikiAnalytics.exe	82
PID 3040 wrote to memory of 3732	3040	a937b12034943b8964887060a42c5970_NeikiAnalytics.exe	84
PID 3040 wrote to memory of 3732	3040	a937b12034943b8964887060a42c5970_NeikiAnalytics.exe	84
PID 3040 wrote to memory of 3732	3040	a937b12034943b8964887060a42c5970_NeikiAnalytics.exe	84
PID 3732 wrote to memory of 3320	3732	omsecor.exe	87
PID 3732 wrote to memory of 3320	3732	omsecor.exe	87
PID 3732 wrote to memory of 3320	3732	omsecor.exe	87
PID 3732 wrote to memory of 3320	3732	omsecor.exe	87
PID 3732 wrote to memory of 3320	3732	omsecor.exe	87
PID 3320 wrote to memory of 2592	3320	omsecor.exe	104
PID 3320 wrote to memory of 2592	3320	omsecor.exe	104
PID 3320 wrote to memory of 2592	3320	omsecor.exe	104
PID 2592 wrote to memory of 4688	2592	omsecor.exe	105
PID 2592 wrote to memory of 4688	2592	omsecor.exe	105
PID 2592 wrote to memory of 4688	2592	omsecor.exe	105
PID 2592 wrote to memory of 4688	2592	omsecor.exe	105
PID 2592 wrote to memory of 4688	2592	omsecor.exe	105
PID 4688 wrote to memory of 4364	4688	omsecor.exe	107
PID 4688 wrote to memory of 4364	4688	omsecor.exe	107
PID 4688 wrote to memory of 4364	4688	omsecor.exe	107
PID 4364 wrote to memory of 1220	4364	omsecor.exe	109
PID 4364 wrote to memory of 1220	4364	omsecor.exe	109
PID 4364 wrote to memory of 1220	4364	omsecor.exe	109
PID 4364 wrote to memory of 1220	4364	omsecor.exe	109
PID 4364 wrote to memory of 1220	4364	omsecor.exe	109

C:\Users\Admin\AppData\Local\Temp\a937b12034943b8964887060a42c5970_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a937b12034943b8964887060a42c5970_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Local\Temp\a937b12034943b8964887060a42c5970_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\a937b12034943b8964887060a42c5970_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3320
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2592
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:1220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 268
        8⤵
        Program crash
        
        PID:2408
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 296
        6⤵
        Program crash
        
        PID:4400
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 288
      4⤵
      Program crash
      PID:3868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 288
  2⤵
  - Program crash
  PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2452 -ip 2452
1⤵
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3732 -ip 3732
1⤵
PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2592 -ip 2592
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4364 -ip 4364
1⤵
PID:4884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 a7239ca145b8096e4d14c9f23cc51876946cf1c57c3e45e796bfa3865954057e
MD5 bc1b40ad5fb9fdefd6e82807c7039ba7
SHA1 a1537a028950601b82e61f168a8db3c86eb3e8cb
SHA512 01f0302d26757ae23c6423fec2f4a457ae8cf825fc0813ea1288fa375bbf376045bc8906dfe894731eb74b129614082cd7706e42ba51e2642cee21f5d081bfce
SSDEEP 1536:mnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:mGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 e8c25082e31f9e4839e2736d143b24b802ecebbeebecae4133e904008c683872
MD5 21940f146e4d884a9575b37eca6d0dc6
SHA1 55277a9848929bc4ada0d3ab9320a4066b21c5c7
SHA512 7d1a3972cb34fdabf30a3403cd35357ef7ae1321c711e8a0e1d19ae8ab07f693e3481ec4d03e7d8322a26cd83ca5e924bd6fbf46b1bb958c0e93cc785e24ddec
SSDEEP 1536:TnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:TGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 868fe64140b992cb0cc22b78175e8e431b179675c45fa5315c3ca43cb379ff59
MD5 dbdc758407cdd42d49ec568e80ae9653
SHA1 8a8f6078335c93ae5ba0015a5645425375bd945a
SHA512 f8ffb1f5237c22021345ce636edcde159633f2a3e49fc0a5872a7e47eaa76a0947a2136a3b9992a7e112f7282ac99c30043d418a7c68c9cc954293995454affe
SSDEEP 1536:KnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:KGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1220-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1220-55-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1220-52-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1220-46-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2452-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2592-50-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2592-31-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3040-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3040-6-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3040-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3040-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3320-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3320-28-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3320-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3320-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3320-17-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3320-13-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3320-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3732-10-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4364-42-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4364-51-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4688-34-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4688-40-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4688-35-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads