neconyd | a94805f144eda292b336aafa6781778a3064f182c4b641afbbe0a128411be62e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bebb2104962db94ce9255769debb1e50_NeikiAnalytics.exe
Size 88KB
Sample240519-ptefnshd73
SHA256 a94805f144eda292b336aafa6781778a3064f182c4b641afbbe0a128411be62e
MD5 bebb2104962db94ce9255769debb1e50
SHA1 910bb421e479ed34913b13da5d173b4dfaca9063
SHA512 a843ee99ef2d4169199bb8d783c882c17c54d8367c77f06d5f873ef8bcd509f06f53cbbeb78458b9b603f54f8aeff2797d631a501b004628801f38920ea9a4c4
SSDEEP 1536:Qd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:QdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1468	omsecor.exe
2336	omsecor.exe
2028	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2824	bebb2104962db94ce9255769debb1e50_NeikiAnalytics.exe
2824	bebb2104962db94ce9255769debb1e50_NeikiAnalytics.exe
1468	omsecor.exe
1468	omsecor.exe
2336	omsecor.exe
2336	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 1468	2824	bebb2104962db94ce9255769debb1e50_NeikiAnalytics.exe	28
PID 2824 wrote to memory of 1468	2824	bebb2104962db94ce9255769debb1e50_NeikiAnalytics.exe	28
PID 2824 wrote to memory of 1468	2824	bebb2104962db94ce9255769debb1e50_NeikiAnalytics.exe	28
PID 2824 wrote to memory of 1468	2824	bebb2104962db94ce9255769debb1e50_NeikiAnalytics.exe	28
PID 1468 wrote to memory of 2336	1468	omsecor.exe	32
PID 1468 wrote to memory of 2336	1468	omsecor.exe	32
PID 1468 wrote to memory of 2336	1468	omsecor.exe	32
PID 1468 wrote to memory of 2336	1468	omsecor.exe	32
PID 2336 wrote to memory of 2028	2336	omsecor.exe	33
PID 2336 wrote to memory of 2028	2336	omsecor.exe	33
PID 2336 wrote to memory of 2028	2336	omsecor.exe	33
PID 2336 wrote to memory of 2028	2336	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\bebb2104962db94ce9255769debb1e50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bebb2104962db94ce9255769debb1e50_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 da66248ac2bbe748bb74d39a14c222569ba270d3b01b2fe050c21dc3e41bccf5
MD5 0df2985a2df0a45910f3a6d060eb8e89
SHA1 9dc74488b66c891f5b82cd2043994f6da2cbd133
SHA512 c416ebef71a8249e82b8c25599e8211d66ea51ca6fa6f8f4271863ceac2fe32efbd088e9f2cbd2d9c3704753c5d3fe26364ea33eac690d51b7f997b72d02dffd
SSDEEP 1536:Fd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:tdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 1038a33c7403f9fa7da9e39e16c6a036ce6125d07d906b9418fe11f1c16601f9
MD5 a63dc08f7399c1926873766af230babe
SHA1 250b002387119d40fba97dd54f94f482c1c710be
SHA512 820f08672e2742f4219385824155e51f37c36e3d7d6cc5ad14399ffb76e706e0851fd901dd03bebca83d29c953f09b2406b7e35c073b4446ff6b6155ff24287d
SSDEEP 1536:cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:kdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 350f3d3f19e5fbdaeea70b0d8d64125977b4393fdfd6c405d28a2c0aff16907b
MD5 818502ff99c65ed81c07671e92419b9c
SHA1 db1ad6f968408185c30287c9ee7a1c20944d3719
SHA512 8740a9761d14fa677d46d9fa76f156f4558eb302591127b89b8e38428e429db886d35778be72d1dfa5c17703678b9b63ce3f4302c488752bd8ef5510e427d93f
SSDEEP 1536:pd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:pdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads