neconyd | 2c7f34d4ce9ac0f9d04fd7bca50d05e15ed62afcd446fba2f4e0cbd9441fb529

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 20:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1b8c29c6b577ac6859a05a89c7c948b0_NeikiAnalytics.exe
Size 84KB
Sample240522-y31vpsfc36
SHA256 2c7f34d4ce9ac0f9d04fd7bca50d05e15ed62afcd446fba2f4e0cbd9441fb529
MD5 1b8c29c6b577ac6859a05a89c7c948b0
SHA1 247b5f73204487126ee1ca3014503fad051a0dee
SHA512 a39f3973bd2bf4905725e1a0b88e6fb8dfdcc94e731d10e03301277e7a7f2120cb1eaac1238626ad2fc073a740c27cf333d984c0b3a9fe25a3e4afbdad27daad
SSDEEP 1536:Dd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:jdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1012	omsecor.exe
5064	omsecor.exe
700	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 1012	5064	1b8c29c6b577ac6859a05a89c7c948b0_NeikiAnalytics.exe	82
PID 5064 wrote to memory of 1012	5064	1b8c29c6b577ac6859a05a89c7c948b0_NeikiAnalytics.exe	82
PID 5064 wrote to memory of 1012	5064	1b8c29c6b577ac6859a05a89c7c948b0_NeikiAnalytics.exe	82
PID 1012 wrote to memory of 5064	1012	omsecor.exe	98
PID 1012 wrote to memory of 5064	1012	omsecor.exe	98
PID 1012 wrote to memory of 5064	1012	omsecor.exe	98
PID 5064 wrote to memory of 700	5064	omsecor.exe	99
PID 5064 wrote to memory of 700	5064	omsecor.exe	99
PID 5064 wrote to memory of 700	5064	omsecor.exe	99

C:\Users\Admin\AppData\Local\Temp\1b8c29c6b577ac6859a05a89c7c948b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1b8c29c6b577ac6859a05a89c7c948b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 802629ce20ecb5a3681813ba7d4f8e1ad7254dd8227ca76edd5040905f79a216
MD5 f0eb037299fab66ec4aa03364bf1fb41
SHA1 7ea230d9f4dad9b45d7b4d4686b853137aaf2dbf
SHA512 f3c896cb988a7155e17ec00e0438c340b8b03050063fc57676fa2fb3517f8cb50839dce5e3bd980486f72476c045477c845faae9ba6b32137c22bbd504eddb67
SSDEEP 1536:Sd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:idseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 294b8d3062ec768e328932a1a29165b7079847e99c49b8be30fdf2e9acbe2f93
MD5 5945aa58a7781fed88f3f3e309a7616e
SHA1 4b8fea6ac67e289ecb1736939916c9b4e7b7512b
SHA512 395dc6329aec2913a1ecdeb8727c2cdac364e61f7008685981fda108bd1ff5e219dd3d2e5aa86a7047f4b4a21eb562b84ca77a2f6648fca52633429b14ff5cb2
SSDEEP 1536:bd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:rdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 88dc94d4a6321f2c8c5bef945cb0ae3c37168ef5be5a034892757ccae7d2db74
MD5 7da11d87323326f8bd9641d672c40ed0
SHA1 f49575a93374b5c470a73411421edb132d89fa49
SHA512 a538ecfe92fe5be524a0c4238869c8ded1b801058bfc05ca559a41fd48d4b194a20bea10c24031c7b30bb775e4718bdb1610ccc69744e40b116c47c0ba7b2662
SSDEEP 1536:id9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:SdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads