neconyd | 47ab902eec098f0bc032806dc1a398f97ce489a16fdefd9a45a3e9797b14f1e0

General

Target

afbb7bec4957278a457404553dd653c0_NeikiAnalytics.exe
Size

35KB
MD5

afbb7bec4957278a457404553dd653c0
SHA1

a5a833b252e36a9abfaaab1fe69de162fb46218a
SHA256

47ab902eec098f0bc032806dc1a398f97ce489a16fdefd9a45a3e9797b14f1e0
SHA512

59489ed4e084134b0567964ee97dd43ff6b201832c06636b25267f84e9a3d087fb92c45906cd9bb56f1b9debcc621c94aadbd3f0e053aaef23e0e3ab59e20d1d
SSDEEP

768:i6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:R8Z0kA7FHlO2OwOTUtKjpB

Score

10^/10

neconyd trojan upx

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1256	omsecor.exe
1856	omsecor.exe
1668	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2008	afbb7bec4957278a457404553dd653c0_NeikiAnalytics.exe
2008	afbb7bec4957278a457404553dd653c0_NeikiAnalytics.exe
1256	omsecor.exe
1256	omsecor.exe
1856	omsecor.exe
1856	omsecor.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2008-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x000c00000001342e-2.dat	upx
behavioral1/memory/1256-13-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2008-11-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1256-14-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1256-17-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1256-20-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1256-23-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-25.dat	upx
behavioral1/memory/1256-27-0x00000000007E0000-0x000000000080D000-memory.dmp	upx
behavioral1/memory/1256-34-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1856-37-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x000c00000001342e-38.dat	upx
behavioral1/memory/1668-46-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1668-48-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1668-51-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1256	2008	afbb7bec4957278a457404553dd653c0_NeikiAnalytics.exe	28
PID 2008 wrote to memory of 1256	2008	afbb7bec4957278a457404553dd653c0_NeikiAnalytics.exe	28
PID 2008 wrote to memory of 1256	2008	afbb7bec4957278a457404553dd653c0_NeikiAnalytics.exe	28
PID 2008 wrote to memory of 1256	2008	afbb7bec4957278a457404553dd653c0_NeikiAnalytics.exe	28
PID 1256 wrote to memory of 1856	1256	omsecor.exe	32
PID 1256 wrote to memory of 1856	1256	omsecor.exe	32
PID 1256 wrote to memory of 1856	1256	omsecor.exe	32
PID 1256 wrote to memory of 1856	1256	omsecor.exe	32
PID 1856 wrote to memory of 1668	1856	omsecor.exe	33
PID 1856 wrote to memory of 1668	1856	omsecor.exe	33
PID 1856 wrote to memory of 1668	1856	omsecor.exe	33
PID 1856 wrote to memory of 1668	1856	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\afbb7bec4957278a457404553dd653c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\afbb7bec4957278a457404553dd653c0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
35KB

MD5
3b656d2e78fc5933bee0e2a7ba8e7d68

SHA1
f840ed74e47e4f4c72767a07eafd94c4c09b1858

SHA256
49e11a9bcc4bff373a6d1ba94792bbeb8fbcc08cb8e3e9c829462f67ddae3044

SHA512
c5a5d85dafbf0c5273555678ea8017884ada5a96f05cc13beebf8718fdcd50b851a3737bca2a6ab031fc59c32c8fa0934f471a075626e469e691c48cb5213ba5

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
35KB

MD5
9d61a2608be1f14a6d2755995bcc7e12

SHA1
ede2f1f8e460fb9cac5081af740d1e8b7fba7fcc

SHA256
d219f4151b49c36fc8a62c51a40dd0dfa7b00d468afea726a4256a877f4aaaf3

SHA512
6cb6c6452b27dbcfd19bdd7b3a1d1840aff71dba4a9649043b2bfc6c14f408a107446b59daea50eb9f56a2ea477f90000f627fd45db089630dcfd0107c03a4f0

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
35KB

MD5
6968d34e1bf8844b08942bf99c0b9aa6

SHA1
defede78ca716e9f7843cd996d68bb5da1fec9ab

SHA256
b761128aaf2c8478e6ec30caf6145902e184cc6106e74bf63c65e53edcc1dbe7

SHA512
08d3835b9e1727dac4d76be03108907a49eb7ba99a77c862abb15385af8f95d478f74afc1405475cf99acf770238bdaefbd71b284222052341d6b29b56652706

Download Submit
memory/1256-13-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1256-14-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1256-17-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1256-20-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1256-23-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1256-27-0x00000000007E0000-0x000000000080D000-memory.dmp

Filesize
180KB

Download
memory/1256-34-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1668-48-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1668-51-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1668-46-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1856-37-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2008-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2008-11-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2008-8-0x0000000000430000-0x000000000045D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing