neconyd | 8da2f608528331dbd1ddcc3500575fcb54ebeab692b5865b22166f84e18285b3

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1918d9b514799d520138f35cd790f970_NeikiAnalytics.exe
Size 92KB
Sample240519-xdr1tscc26
SHA256 8da2f608528331dbd1ddcc3500575fcb54ebeab692b5865b22166f84e18285b3
MD5 1918d9b514799d520138f35cd790f970
SHA1 56878704a2c83fc1b24a1e7fe11e509e2a760d3b
SHA512 2d9504c220125d9ac29004723f0f87ccfc92b3d6eec0a607e776e81a13ee9852986f2ee3bfbd3bc9526de024f56d8c7eeb62ed586685192b34bb70e185e210d3
SSDEEP 768:MMEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:MbIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1516	omsecor.exe
3364	omsecor.exe
4620	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1516	1528	1918d9b514799d520138f35cd790f970_NeikiAnalytics.exe	82
PID 1528 wrote to memory of 1516	1528	1918d9b514799d520138f35cd790f970_NeikiAnalytics.exe	82
PID 1528 wrote to memory of 1516	1528	1918d9b514799d520138f35cd790f970_NeikiAnalytics.exe	82
PID 1516 wrote to memory of 3364	1516	omsecor.exe	100
PID 1516 wrote to memory of 3364	1516	omsecor.exe	100
PID 1516 wrote to memory of 3364	1516	omsecor.exe	100
PID 3364 wrote to memory of 4620	3364	omsecor.exe	101
PID 3364 wrote to memory of 4620	3364	omsecor.exe	101
PID 3364 wrote to memory of 4620	3364	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\1918d9b514799d520138f35cd790f970_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1918d9b514799d520138f35cd790f970_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3364
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 ba402fb1a953309bbc16b24d8bce2bb3848f3117904b3c291aad3e41a0ea5f3f
MD5 3e89e5c0df78fd2d446fe4f4f6cd3f09
SHA1 3fb09031c2660ad56544c0e52585e7b1f97e731f
SHA512 2202cf1dc7b3ef2b9c8271e0e47a2570b0cf8bff7d85f68e248d382ac238e62d4117c3514627beedcceff506de98b72dbca050d37e20d5cb6949115dc0b2cae1
SSDEEP 768:JMEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:JbIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 ad8565a16403aa4239029694ace79a6c4ed9939d76263fdf58acd88a1c9c2ba7
MD5 48c25827d0468c208437fd2523217c7f
SHA1 be7409cd8d43516fe108aa9975cce1f82f8bb4b1
SHA512 535ac55f9d3e4fa83a4b26219db80564a372e25347c7f0921958597bc8478f28955291d4d9d40bbf49bfd6cce44e745bfbf6e40c2b710fb7c0bdc46f6f65f1b0
SSDEEP 768:8MEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:8bIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 92KB
SHA256 337b3f4a3e5722ff07c943c22e7e453b64fe23cd6d210125a24c57475874e11e
MD5 6f99c4dd71ec20667f75a9cc6f533892
SHA1 5ebdbe0278560852d1b50513c6a0a5250d650976
SHA512 ce1e597855cba128ad23af3635361f0f7973c38dbe170282479f55bd96192256879df392da8e0b7e1e05c51976b4b3afb8149199b933945e14a40cfc8410180a
SSDEEP 768:tMEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:tbIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1516-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1516-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1516-11-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1528-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1528-5-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3364-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3364-17-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4620-18-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4620-20-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads