neconyd | a80fcd73eadbeb5ef9c89c0feefd44bd1f4fd1d040e0fa7a150cd4befb271ecb

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 11:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a87f4486b4e46928f9766ea7862abff3_NeikiAnalytics.exe
Size 80KB
Sample240519-m6cfqsfa59
SHA256 a80fcd73eadbeb5ef9c89c0feefd44bd1f4fd1d040e0fa7a150cd4befb271ecb
MD5 a87f4486b4e46928f9766ea7862abff3
SHA1 1d5ba6b146ad68ee233843ef63b45e94c4ff2ac7
SHA512 91be8349315518098033485a10728cccc6becd7179eb85ae0b2d9b72737ce097c8eb2ecf876e51c3286601759398b7da4ef41aa8007b706e6d4692fa5923968e
SSDEEP 768:SfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:SfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
936	omsecor.exe
2964	omsecor.exe
1420	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 936	1972	a87f4486b4e46928f9766ea7862abff3_NeikiAnalytics.exe	83
PID 1972 wrote to memory of 936	1972	a87f4486b4e46928f9766ea7862abff3_NeikiAnalytics.exe	83
PID 1972 wrote to memory of 936	1972	a87f4486b4e46928f9766ea7862abff3_NeikiAnalytics.exe	83
PID 936 wrote to memory of 2964	936	omsecor.exe	99
PID 936 wrote to memory of 2964	936	omsecor.exe	99
PID 936 wrote to memory of 2964	936	omsecor.exe	99
PID 2964 wrote to memory of 1420	2964	omsecor.exe	100
PID 2964 wrote to memory of 1420	2964	omsecor.exe	100
PID 2964 wrote to memory of 1420	2964	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\a87f4486b4e46928f9766ea7862abff3_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a87f4486b4e46928f9766ea7862abff3_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 80KB
SHA256 1f5e2e945ad9d60344145a0b707e6247db6fd8f2f05ea3da3970227bb0070d0f
MD5 65070bdcd5020ee4bba283947d4d08d2
SHA1 f83cc4e2b5aec4044f261f084c63e392dc7ba9be
SHA512 8c6d6afc325ae91a6e278e571e8986846b858e55c470773955187a281f37c2684e647b8786bcccd8e7654b9905265c0f8002bae7cc2671605fe81d5262997e85
SSDEEP 768:WfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:WfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 80KB
SHA256 46ef0bc157403009f09cd57e6bc320a663cfaf596d41c3cdf1c1927b2d1042d2
MD5 14c1f1b42b12e8f12cf58ad9e8e5c042
SHA1 3920ab9df28eb87c8a4391cde0659229b5fdd9a7
SHA512 07d3b5e44596770d43d402ece0f16c1d890dae8b6afe322b500c9e85139b69c01501f1fca7a693adfd359b91aa1df9abbe740e316c4bb2e917c6de76b792a61d
SSDEEP 768:KfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:KfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 80KB
SHA256 b8b4cea709c13173a1f2b49c2d574868dff1683822b4c5e6bd363e4f6bd3b1b1
MD5 10548db78a79c5012e0aa40c6d731662
SHA1 6b770509fe2e96e4dee044a730fb6dace076c9c4
SHA512 6b474eb50c56faca9b8e36255c154f3ea014281c239e87953051358cf603eefab35662527a4e35bd781826264ef8493551197240097271b83b683127de397158
SSDEEP 768:WfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:WfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads