neconyd | 228ee0146df5d8e9a048765c19b798da68504acd8d2f5740ddc1d7479cbce04c

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
228ee0146df5d8e9a048765c19b798da68504acd8d2f5740ddc1d7479cbce04c_NeikiAnalytics.exe
Size 89KB
Sample240521-keyhsaef66
SHA256 228ee0146df5d8e9a048765c19b798da68504acd8d2f5740ddc1d7479cbce04c
MD5 4c20d38ad81b1a6eb744901ad493cea0
SHA1 4c24d0cb0e870b2f16e3cdcda5670e7af7631bc1
SHA512 8f8366c4e5f8d30f2030b2c64636556c373991f1d034286c39f7651d74dde69585fc05da3450dae1018c5bb3a04c51e70da8451a68bb80e18d676d4d5397bfca
SSDEEP 768:AMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:AbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1556	omsecor.exe
4688	omsecor.exe
4580	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 1556	4044	228ee0146df5d8e9a048765c19b798da68504acd8d2f5740ddc1d7479cbce04c_NeikiAnalytics.exe	83
PID 4044 wrote to memory of 1556	4044	228ee0146df5d8e9a048765c19b798da68504acd8d2f5740ddc1d7479cbce04c_NeikiAnalytics.exe	83
PID 4044 wrote to memory of 1556	4044	228ee0146df5d8e9a048765c19b798da68504acd8d2f5740ddc1d7479cbce04c_NeikiAnalytics.exe	83
PID 1556 wrote to memory of 4688	1556	omsecor.exe	101
PID 1556 wrote to memory of 4688	1556	omsecor.exe	101
PID 1556 wrote to memory of 4688	1556	omsecor.exe	101
PID 4688 wrote to memory of 4580	4688	omsecor.exe	102
PID 4688 wrote to memory of 4580	4688	omsecor.exe	102
PID 4688 wrote to memory of 4580	4688	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\228ee0146df5d8e9a048765c19b798da68504acd8d2f5740ddc1d7479cbce04c_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\228ee0146df5d8e9a048765c19b798da68504acd8d2f5740ddc1d7479cbce04c_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 89KB
SHA256 eba21a9c92f2d3aa75817be8cf57b5ef981b0b2ee8be4c05909bd24f3953d3c0
MD5 11412191c9aea90a444a60fd1269735a
SHA1 650ca2dbe0b409a9e2340813c4323e34168c2207
SHA512 e7792c30c2aff3ac80f4d27ebda172ddb61f219d8b6204df17274d1f84998474323ced187610e2b9bb2a66291e152c36ac54b0d20638087b7baf2a03aada697d
SSDEEP 768:xMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:xbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 89KB
SHA256 1b3b233768b6a150fcf5ba47f764048828f09cb799f7ef685a7c92939b8660ce
MD5 aa5e9854c4e6355129f89f83c610c7f5
SHA1 636266bb6a266aa02c94c28e616f510cc629e4b6
SHA512 56b1f97f8b703997468c6119f17cb485f4264388b2867b27ab1d7e15609e81861f942371ff6b4f998d4e01aca383df3e0f17611b161afe63357778db1bbbfe92
SSDEEP 768:IMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:IbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 89KB
SHA256 d79710db2f749d0d234512f3c65473ebda254adc6d837e869cc68ed8ced359b0
MD5 7c49477ee62267fcd43cc768924d6f1e
SHA1 66e0e5311aba85637db63b65c245403cdf110433
SHA512 5b5ecd1a703b0190e2efa8fc4b065cc7283261f8952a44bf6ebf9f56df39bfd0e153ef4a6732d2c494220de6037dbcbdca3f524a1152adda45a0d29014f21f5f
SSDEEP 768:9MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:9bIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads