neconyd | 3ca867ba879dd54d8f738bb10f94f340c1b2fa02308a6ce7772b218f650d5d62

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 11:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b0dea26629891edb4c1807af1c2244d0_NeikiAnalytics.exe
Size 84KB
Sample240519-nkhajafe8t
SHA256 3ca867ba879dd54d8f738bb10f94f340c1b2fa02308a6ce7772b218f650d5d62
MD5 b0dea26629891edb4c1807af1c2244d0
SHA1 b68789611983a565e9254d65bfd8eba8c15d548f
SHA512 02830d6f863e69f31556287614f10318f7d0cc7886f57e6b2720cbf9fadcf53dec46e75691d8b46117e210dc388290f9af4dbdafefe5e7ffd437409e5d13dc97
SSDEEP 1536:Ld9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:7dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
264	omsecor.exe
2180	omsecor.exe
1532	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 264	1532	b0dea26629891edb4c1807af1c2244d0_NeikiAnalytics.exe	83
PID 1532 wrote to memory of 264	1532	b0dea26629891edb4c1807af1c2244d0_NeikiAnalytics.exe	83
PID 1532 wrote to memory of 264	1532	b0dea26629891edb4c1807af1c2244d0_NeikiAnalytics.exe	83
PID 264 wrote to memory of 2180	264	omsecor.exe	98
PID 264 wrote to memory of 2180	264	omsecor.exe	98
PID 264 wrote to memory of 2180	264	omsecor.exe	98
PID 2180 wrote to memory of 1532	2180	omsecor.exe	99
PID 2180 wrote to memory of 1532	2180	omsecor.exe	99
PID 2180 wrote to memory of 1532	2180	omsecor.exe	99

C:\Users\Admin\AppData\Local\Temp\b0dea26629891edb4c1807af1c2244d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b0dea26629891edb4c1807af1c2244d0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 a70c7297b9d4634538811cb371790699020e838ed543cf4d10f2a81cbfbadc8d
MD5 2dc36fd34d02bf352676c77948db493f
SHA1 3e196e652cebb64fbf1a563290a8290441e5e6e1
SHA512 7133c5eef6160350f441c66d47cb24d85b01222c88d7a24e1f57afcc505c9b25c785b665ab722133de5b58ff91c5a5b75cd764c063e510a9595c750a43569ff9
SSDEEP 1536:jd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:DdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 2f1917810fc028b7ace537305a299c1846faf0515cb7c0f6fb2599ee6e87ac59
MD5 e8deb88dfb8c65b1a1cb87a9556c799d
SHA1 6d48e28b5c58a4e2072c03a11200b5998c55a905
SHA512 73e35e7edb91f303be680bee6461dcd66d21b6fbbf8c7b2602c8c1912f7298580abdc64d0be2f69f97b905452514e92f73d33c775819b3af1ffe9b6f13ed7378
SSDEEP 1536:Vd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:ddseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 bfbb2e88e4c7a2828533b2848abca53682df86b9fb09bf7dce519eb0af515d39
MD5 789e3e107972baba7a12218e1cf4f5dc
SHA1 5ef0fdae74752a00424f39918f35fca396a81e6b
SHA512 ae27ac77a6ba1ac94e16d1922cad12d6fd74d7b97d396f13bf1f6891c56affe00122c8cd6e5599dcbc0da8b39efc180a17ec095e683d7c82dc3981352ca5a9cf
SSDEEP 1536:hd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:RdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads