neconyd | 14921464e306818bf8f00c15755d11d7ffdfe0fac41d2171acf05cd96fcc8776

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 06:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14921464e306818bf8f00c15755d11d7ffdfe0fac41d2171acf05cd96fcc8776_NeikiAnalytics.exe
Size 84KB
Sample240521-hpb2esca25
SHA256 14921464e306818bf8f00c15755d11d7ffdfe0fac41d2171acf05cd96fcc8776
MD5 0789034351c8c03365bcdb1425bcb720
SHA1 105cd5e2e0aa963a9fb040fb00a2221e7a96d5b7
SHA512 b6933c88f395728f22d7d0941520b65c90a332d2e61340d6275b0bd02cd8e7b619e23f321e1e3f75123c1fb2c904bd81f526697e6a6a6cc0d66a9ba6b4d49fc5
SSDEEP 1536:Td9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:TdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2108	omsecor.exe
4736	omsecor.exe
3400	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 2108	220	14921464e306818bf8f00c15755d11d7ffdfe0fac41d2171acf05cd96fcc8776_NeikiAnalytics.exe	83
PID 220 wrote to memory of 2108	220	14921464e306818bf8f00c15755d11d7ffdfe0fac41d2171acf05cd96fcc8776_NeikiAnalytics.exe	83
PID 220 wrote to memory of 2108	220	14921464e306818bf8f00c15755d11d7ffdfe0fac41d2171acf05cd96fcc8776_NeikiAnalytics.exe	83
PID 2108 wrote to memory of 4736	2108	omsecor.exe	101
PID 2108 wrote to memory of 4736	2108	omsecor.exe	101
PID 2108 wrote to memory of 4736	2108	omsecor.exe	101
PID 4736 wrote to memory of 3400	4736	omsecor.exe	102
PID 4736 wrote to memory of 3400	4736	omsecor.exe	102
PID 4736 wrote to memory of 3400	4736	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\14921464e306818bf8f00c15755d11d7ffdfe0fac41d2171acf05cd96fcc8776_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\14921464e306818bf8f00c15755d11d7ffdfe0fac41d2171acf05cd96fcc8776_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 8c7ffb368322734ab00263ee64390e94d7deb68664f6feb4fa00c22a593ec4e6
MD5 491f060f83bfb8080b78c67da2f3cb85
SHA1 d8c53c5316a72b0485d63a56c96e1747c37f097b
SHA512 6e2964b4ed1624ba91fd7aeb4cf0ba9db2547834a4fbc6b429f0a0f423e4a71231a86fb9872e234a07446ed9c17d92c0b14a04c412df84fe5e40488a62e218ee
SSDEEP 1536:zd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:zdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 98a4075a6a9814f99c6ac464a1ab85ecbee786beb76d87131861b69631c475ab
MD5 e9d56f4dc84dbcd469d308b2e492f84e
SHA1 a1e2c71b608544264fa322898efbd3972c3e21d6
SHA512 999f6abcb284811005942af1d7853e00c9f8fdd3350e5f41f9695bad08625674d4422fab2010cebeb124f990c11fab72f9ced6069b5e28492e108816c483b0e9
SSDEEP 1536:bd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:rdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 c1ca73cd9a6ff9373c721e19038651b1d59ed2c2019845bd53023e3627365a7a
MD5 637dd1b94430ae34ec9042d7ed48f304
SHA1 1ea80c00520fe9fb960639a9fd00d44126de4728
SHA512 f14cea03e8948692405868997e1c54ccd7c18c1b28996654939699df3d71e7ce0629216c9a7fc9b01f07b0c21b3450459163a69fb0320dac3459a9571ffcef9f
SSDEEP 1536:id9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:SdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads