neconyd | 366d37bb62332ade639e36198850a3cb0598115fb45fb602c4707066d5021cd2

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4db0117ad8cfc5fd64f7d4272f420da0_NeikiAnalytics.exe
Size 84KB
Sample240522-2jfl7sbe8v
SHA256 366d37bb62332ade639e36198850a3cb0598115fb45fb602c4707066d5021cd2
MD5 4db0117ad8cfc5fd64f7d4272f420da0
SHA1 2cae2ec3dee933468084879f37d11018786aadb0
SHA512 760361e0538375111165e9d5045ff11e2841ff12100274aa3fb9bd2b2c3c331c443213014683a69ebc7eaefc8950309b3fab6aa6447839798bd1fea31f8430d4
SSDEEP 1536:8d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:EdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4876	omsecor.exe
5116	omsecor.exe
3064	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 4876	3528	4db0117ad8cfc5fd64f7d4272f420da0_NeikiAnalytics.exe	83
PID 3528 wrote to memory of 4876	3528	4db0117ad8cfc5fd64f7d4272f420da0_NeikiAnalytics.exe	83
PID 3528 wrote to memory of 4876	3528	4db0117ad8cfc5fd64f7d4272f420da0_NeikiAnalytics.exe	83
PID 4876 wrote to memory of 5116	4876	omsecor.exe	99
PID 4876 wrote to memory of 5116	4876	omsecor.exe	99
PID 4876 wrote to memory of 5116	4876	omsecor.exe	99
PID 5116 wrote to memory of 3064	5116	omsecor.exe	100
PID 5116 wrote to memory of 3064	5116	omsecor.exe	100
PID 5116 wrote to memory of 3064	5116	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\4db0117ad8cfc5fd64f7d4272f420da0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4db0117ad8cfc5fd64f7d4272f420da0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 895f6fd5f4a6b180e7785b55e0b6ab26298c72906cd7d4a9f133189c74823519
MD5 03aa5772be862c14f0ab990321826cb5
SHA1 10409db562f031d261365030eedf4c26ef494a3a
SHA512 e57877ca2c303af13f788d8dca6b1b333cd85ced15d5c15f386a4505bb3238edd3901e4d9374102c36c6655a46265c7ae37d433654c751e691ea9dac0628e2d5
SSDEEP 1536:Ad9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:gdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 7a1da6cf5194750c3d16d87238493ab4675db6cff194d5fb9c76451c39da2f8f
MD5 4d0c3350d3d40ef785d20f1adf1f919e
SHA1 bcdd56193b9db85253df8dd421a2fd34c8687d72
SHA512 ffb5a4313882f7161d166cafb76193b07658b3e63635753d57d5fb50f9af8d49aa592c6b0cb510381fdbe54b8bc2590ad58a99ab2fbc6e3fdea05123f121bfaf
SSDEEP 1536:4d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:IdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 e7973b783f04bd5b2b17d686d5e57dbb8aa340f37c0a2a9062853c5efed8e40f
MD5 249fe9d80fab000d2a885eaabaebecae
SHA1 434415ba5959d5e234a636ea96bba3d81232dabe
SHA512 b0cb2dfababd330c88bca3124d4574cc98cdee5a74cea09d37abb88ac4c0c944957ae98583df81cc9fd75ca7f401603e6d170c643e4a1519dff923f4ccdaad60
SSDEEP 1536:8d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:EdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads