neconyd | 08ec2af680d9e1a17e8a14f174f85f84e18c0d77b0ba5edfa74d0c02495e2124

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 16:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f1443d530c33991545851fd1fc8f64d0_NeikiAnalytics.exe
Size 35KB
Sample240519-tv1grafc8x
SHA256 08ec2af680d9e1a17e8a14f174f85f84e18c0d77b0ba5edfa74d0c02495e2124
MD5 f1443d530c33991545851fd1fc8f64d0
SHA1 25f13fbd840e3dce09526506b08e900c5b4a2fb2
SHA512 5a41735166eeb337280cc180291510652d796b8e835e8539cc3d6da186e6481b05268f5ea5176210ed7c26af4b2264bbea2c8aae6d0b0f963845b0ab263b96f0
SSDEEP 768:k6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:z8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
3000	omsecor.exe
1220	omsecor.exe
2412	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1600	f1443d530c33991545851fd1fc8f64d0_NeikiAnalytics.exe
1600	f1443d530c33991545851fd1fc8f64d0_NeikiAnalytics.exe
3000	omsecor.exe
3000	omsecor.exe
1220	omsecor.exe
1220	omsecor.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1600-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x000d00000001228a-2.dat	upx
behavioral1/memory/1600-4-0x0000000000230000-0x000000000025D000-memory.dmp	upx
behavioral1/memory/3000-13-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1600-10-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/3000-14-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/3000-17-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/3000-20-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/3000-23-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-25.dat	upx
behavioral1/memory/3000-26-0x0000000000290000-0x00000000002BD000-memory.dmp	upx
behavioral1/memory/3000-34-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x000d00000001228a-38.dat	upx
behavioral1/memory/1220-37-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2412-46-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2412-48-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2412-51-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 3000	1600	f1443d530c33991545851fd1fc8f64d0_NeikiAnalytics.exe	28
PID 1600 wrote to memory of 3000	1600	f1443d530c33991545851fd1fc8f64d0_NeikiAnalytics.exe	28
PID 1600 wrote to memory of 3000	1600	f1443d530c33991545851fd1fc8f64d0_NeikiAnalytics.exe	28
PID 1600 wrote to memory of 3000	1600	f1443d530c33991545851fd1fc8f64d0_NeikiAnalytics.exe	28
PID 3000 wrote to memory of 1220	3000	omsecor.exe	32
PID 3000 wrote to memory of 1220	3000	omsecor.exe	32
PID 3000 wrote to memory of 1220	3000	omsecor.exe	32
PID 3000 wrote to memory of 1220	3000	omsecor.exe	32
PID 1220 wrote to memory of 2412	1220	omsecor.exe	33
PID 1220 wrote to memory of 2412	1220	omsecor.exe	33
PID 1220 wrote to memory of 2412	1220	omsecor.exe	33
PID 1220 wrote to memory of 2412	1220	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\f1443d530c33991545851fd1fc8f64d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f1443d530c33991545851fd1fc8f64d0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 ade72ea8b9797d187e0fdb5b425620fa1d6dee780625f96e6fb552d91ff33b17
MD5 7e8ade6d5357893def7071140dff6f30
SHA1 a7d883fe8e4344cf422ece5e06fbabd04627a568
SHA512 1745702e1670f1f129be21554101aa71235df82f60d061607b6d70c0c8e484bbf6de1766de5f3d760b342beaf8f1988f7d2ab2fdfb6df3d05c6ba009f0145d40
SSDEEP 768:T6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:O8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 92404d891f448b7f9918442681650a6ee7cd4cb98a58c125019b669ef6a13f83
MD5 d7b126af241a909837b08f6b6518dd0c
SHA1 aff1656886a6b73ff7509456d29ac5bf56a517db
SHA512 1f330753c898bc6339bb95c33ba74c01684d6140a53b55bae964089624465d53e2181b0fcad69e300224445887302e04b1de946a47eecdb3894fe4b6bae121a6
SSDEEP 768:Q6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:n8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 35KB
SHA256 600adc28534e98cb4737436e0601497e1f627841238ebb123c5506a69e93d7f6
MD5 1886ecf7911fc45e2b01ddbb0c10ffca
SHA1 93b3fafff7f23d558492197ebd4ec2bc7b19927b
SHA512 33647bac8341f6c4e2f764a1089622602b9bb4e8e1abcd56c1e49c7a3ae45eb12a7239ace446f70ca90ed392cf84bf0000baa481bf29eb7616c77a3f1b17f46c
SSDEEP 768:86vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:78Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1220-37-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1600-10-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1600-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1600-4-0x0000000000230000-0x000000000025D000-memory.dmp

Download

memory/2412-46-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2412-48-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2412-51-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3000-14-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3000-17-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3000-20-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3000-23-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3000-26-0x0000000000290000-0x00000000002BD000-memory.dmp

Download

memory/3000-34-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3000-13-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads