neconyd | 924c1e7c7bcedbaba20271b0f681868103d46999cdacbee6e51b62a7a4fbcd43

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 02:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7973d9066da647d82396600d464cf940_NeikiAnalytics.exe
Size 72KB
Sample240523-c4eg7sba83
SHA256 924c1e7c7bcedbaba20271b0f681868103d46999cdacbee6e51b62a7a4fbcd43
MD5 7973d9066da647d82396600d464cf940
SHA1 0b83d86b776a2abead9d9510e9953255fa608b3e
SHA512 0bee5722eb68393fc57a4b3b11fac3f07115f0816ed47133cceb3a99299c772ce344a594359d23971bc66c34bf4169b43e3dcd1b6b0582f1027a184705e85659
SSDEEP 768:5MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:5bIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
3012	omsecor.exe
4180	omsecor.exe
1720	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 3012	4072	7973d9066da647d82396600d464cf940_NeikiAnalytics.exe	83
PID 4072 wrote to memory of 3012	4072	7973d9066da647d82396600d464cf940_NeikiAnalytics.exe	83
PID 4072 wrote to memory of 3012	4072	7973d9066da647d82396600d464cf940_NeikiAnalytics.exe	83
PID 3012 wrote to memory of 4180	3012	omsecor.exe	100
PID 3012 wrote to memory of 4180	3012	omsecor.exe	100
PID 3012 wrote to memory of 4180	3012	omsecor.exe	100
PID 4180 wrote to memory of 1720	4180	omsecor.exe	101
PID 4180 wrote to memory of 1720	4180	omsecor.exe	101
PID 4180 wrote to memory of 1720	4180	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\7973d9066da647d82396600d464cf940_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7973d9066da647d82396600d464cf940_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 61a8ae90d4dd70767a3d3b3779ccd1ad11f101cdcb7fe20732707ec166587efe
MD5 70c1747a73fca8df3540150b215056e7
SHA1 5f262fadef650ccb3211734b75771aebde72b890
SHA512 de9402512aae51371ed1c1e672ed87acb835ec5eb667e711d092abdb5cbf666dcb49f9b7dad978f0553bda780e2bd9dc7f25d5ae069ac74c6c0a2a095203d6bd
SSDEEP 768:ZMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:ZbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 0d71fa08c5055f45741c0a3b62ab15adca9288fe76e06ff6e7bc692179274dae
MD5 4a203d0ddbf7945012e29cf25792317f
SHA1 65f53e66eb8a0b0586530e6f81b160083f119ee6
SHA512 b01601e1c76716c1708f01ecd958ddb4b87e54852afcb577e4a9bf85d7db0e9275970eb26fe39c65f90a5065d556502841abb5d54b64379ad25f4fea39a86b67
SSDEEP 768:xMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:xbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 72KB
SHA256 bbdd12dfe7c94dac6ad66c896528d53c4bf1820affc5736b72952810d3efec17
MD5 632ce3d2b6337af28072ec53a280fe9a
SHA1 1475e096a1e8340b7ce03b7385e85dbe891efdef
SHA512 a4142cf1e1d10dad90b5d6f31208a72aebb58de66142dcc77692748b8bcbbcd71b471c93b3d5079be44c89630a8f063bd7feb245ff85a6673a3c852a93e0fa31
SSDEEP 768:hMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:hbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads