neconyd | e441623b3f9fcf537629949deea54867f0e3fcdfa4722afc022b2f2451c32d6e

Analysis

max time kernel
132s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8c17cdc0555a721bafea19150b695460_NeikiAnalytics.exe
Size 92KB
Sample240524-gpsthafg77
SHA256 e441623b3f9fcf537629949deea54867f0e3fcdfa4722afc022b2f2451c32d6e
MD5 8c17cdc0555a721bafea19150b695460
SHA1 404690dac3108e503008c5717906c0381d58bd54
SHA512 a8a3c0dd59681d000ba54fd87d24a5efb9bacb557d80c5b7dc6e030ed1911ddc552cb5a543b634541087293f9ced766f1140ce7075b168f915e024e524251351
SSDEEP 768:JMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:JbIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
2864	omsecor.exe
1856	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 2864	4300	8c17cdc0555a721bafea19150b695460_NeikiAnalytics.exe	90
PID 4300 wrote to memory of 2864	4300	8c17cdc0555a721bafea19150b695460_NeikiAnalytics.exe	90
PID 4300 wrote to memory of 2864	4300	8c17cdc0555a721bafea19150b695460_NeikiAnalytics.exe	90
PID 2864 wrote to memory of 1856	2864	omsecor.exe	100
PID 2864 wrote to memory of 1856	2864	omsecor.exe	100
PID 2864 wrote to memory of 1856	2864	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\8c17cdc0555a721bafea19150b695460_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8c17cdc0555a721bafea19150b695460_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:4572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 f84601adae395665186749022606c8b9989faff56088ed0f9da1df1175e5de39
MD5 950766b18b053ae0a851e7f1b8d3dd69
SHA1 ba64e32dae0f173a8a0ab453721e523676400be2
SHA512 d48883bc6ca6863004298913a13f4d567aac2419dbc2491027667fdfd4040e52d6b7b1e35c56f2aa96c3bd42dc48c841fefc35cde89284d15144e942f6bc8e77
SSDEEP 768:lMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:lbIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 92KB
SHA256 e40eb88c2472a4859d3d0eb5361d3661d45673ac06af74b41d73f79ca0346b75
MD5 df2379aec2f7f0636d4e8a8ab8ef7db0
SHA1 2f5f6a39dcc613cff8260babb6b831afc6b69532
SHA512 6fb4efb2c5e22fa01e49648d09c1030c4e455e196eb353b5e3f7c68ed1348468d60ff76de3a57a7281afa83e5ec01a26095a231ec739a1f1bcfc3aa4a9223acb
SSDEEP 768:GMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:GbIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1856-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1856-14-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2864-4-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2864-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2864-12-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4300-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4300-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads