neconyd | a94805f144eda292b336aafa6781778a3064f182c4b641afbbe0a128411be62e

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bebb2104962db94ce9255769debb1e50_NeikiAnalytics.exe
Size 88KB
Sample240519-ptefnshd73
SHA256 a94805f144eda292b336aafa6781778a3064f182c4b641afbbe0a128411be62e
MD5 bebb2104962db94ce9255769debb1e50
SHA1 910bb421e479ed34913b13da5d173b4dfaca9063
SHA512 a843ee99ef2d4169199bb8d783c882c17c54d8367c77f06d5f873ef8bcd509f06f53cbbeb78458b9b603f54f8aeff2797d631a501b004628801f38920ea9a4c4
SSDEEP 1536:Qd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:QdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1760	omsecor.exe
2064	omsecor.exe
4828	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1760	1316	bebb2104962db94ce9255769debb1e50_NeikiAnalytics.exe	83
PID 1316 wrote to memory of 1760	1316	bebb2104962db94ce9255769debb1e50_NeikiAnalytics.exe	83
PID 1316 wrote to memory of 1760	1316	bebb2104962db94ce9255769debb1e50_NeikiAnalytics.exe	83
PID 1760 wrote to memory of 2064	1760	omsecor.exe	99
PID 1760 wrote to memory of 2064	1760	omsecor.exe	99
PID 1760 wrote to memory of 2064	1760	omsecor.exe	99
PID 2064 wrote to memory of 4828	2064	omsecor.exe	100
PID 2064 wrote to memory of 4828	2064	omsecor.exe	100
PID 2064 wrote to memory of 4828	2064	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\bebb2104962db94ce9255769debb1e50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bebb2104962db94ce9255769debb1e50_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 4776931042c506b3d7b51b25088743fd1c561044dec6de7bad11552889aeb246
MD5 337a44c32c6e2646cb5ed67e65bc4f8d
SHA1 baac8fdfb5579c5d6b9a6353be7568629159b39e
SHA512 79da819179877ab90477639013fb80a2f3f5fd0cd11f3f8ac62c2fa15e77d2c34ba443dbe376f6dce4988546cf666654179552080c4a6667b3dea4a725b163d4
SSDEEP 1536:od9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:YdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 1038a33c7403f9fa7da9e39e16c6a036ce6125d07d906b9418fe11f1c16601f9
MD5 a63dc08f7399c1926873766af230babe
SHA1 250b002387119d40fba97dd54f94f482c1c710be
SHA512 820f08672e2742f4219385824155e51f37c36e3d7d6cc5ad14399ffb76e706e0851fd901dd03bebca83d29c953f09b2406b7e35c073b4446ff6b6155ff24287d
SSDEEP 1536:cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:kdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 e92e0daa1d361f2f12a85e212ef0528edd26f7ce4eb8b7c2dafa373f92eab673
MD5 1abd1fb6a07024921add6c7ee6532ef6
SHA1 bd903fd45cbfb178f054390c9ac26936c0cd5f42
SHA512 cdbc7a012f0437549deeacf8187ac3f389c7b93d25a0647f9425435c664b989681a6f04747d72d0e8c561c9ca3f1996c4c850a2a891bc902cc39826468f8692f
SSDEEP 1536:zd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:zdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads