neconyd | fb8dab1c1267ec31641aa634a7c20f877633732605d887bbaa9feb301976a73e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0510b753c81390d1e63e76eccc36ded0_NeikiAnalytics.exe
Size 134KB
Sample240526-1mskhaea56
SHA256 fb8dab1c1267ec31641aa634a7c20f877633732605d887bbaa9feb301976a73e
MD5 0510b753c81390d1e63e76eccc36ded0
SHA1 938d39fb6ecf0cafcf5a1c79f588b93b05b7e3b4
SHA512 8aa006b4241cc69c4c59ac0513d4bfbdf31c5b468e1259d488f84201d1ac98d4efada66faacf60476d541dfd5b751d02bd9013a1f2d68c42b43a6c43df376f52
SSDEEP 1536:YDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:+iRTeH0NqAW6J6f1tqF6dngNmaZC7M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
3976	omsecor.exe
5112	omsecor.exe
1852	omsecor.exe
4068	omsecor.exe
3856	omsecor.exe
1948	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1700 set thread context of 2396	1700	0510b753c81390d1e63e76eccc36ded0_NeikiAnalytics.exe	83
PID 3976 set thread context of 5112	3976	omsecor.exe	88
PID 1852 set thread context of 4068	1852	omsecor.exe	108
PID 3856 set thread context of 1948	3856	omsecor.exe	111

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1148	1700	WerFault.exe	82
3152	3976	WerFault.exe	85
3176	1852	WerFault.exe	107
1412	3856	WerFault.exe	110

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2396	1700	0510b753c81390d1e63e76eccc36ded0_NeikiAnalytics.exe	83
PID 1700 wrote to memory of 2396	1700	0510b753c81390d1e63e76eccc36ded0_NeikiAnalytics.exe	83
PID 1700 wrote to memory of 2396	1700	0510b753c81390d1e63e76eccc36ded0_NeikiAnalytics.exe	83
PID 1700 wrote to memory of 2396	1700	0510b753c81390d1e63e76eccc36ded0_NeikiAnalytics.exe	83
PID 1700 wrote to memory of 2396	1700	0510b753c81390d1e63e76eccc36ded0_NeikiAnalytics.exe	83
PID 2396 wrote to memory of 3976	2396	0510b753c81390d1e63e76eccc36ded0_NeikiAnalytics.exe	85
PID 2396 wrote to memory of 3976	2396	0510b753c81390d1e63e76eccc36ded0_NeikiAnalytics.exe	85
PID 2396 wrote to memory of 3976	2396	0510b753c81390d1e63e76eccc36ded0_NeikiAnalytics.exe	85
PID 3976 wrote to memory of 5112	3976	omsecor.exe	88
PID 3976 wrote to memory of 5112	3976	omsecor.exe	88
PID 3976 wrote to memory of 5112	3976	omsecor.exe	88
PID 3976 wrote to memory of 5112	3976	omsecor.exe	88
PID 3976 wrote to memory of 5112	3976	omsecor.exe	88
PID 5112 wrote to memory of 1852	5112	omsecor.exe	107
PID 5112 wrote to memory of 1852	5112	omsecor.exe	107
PID 5112 wrote to memory of 1852	5112	omsecor.exe	107
PID 1852 wrote to memory of 4068	1852	omsecor.exe	108
PID 1852 wrote to memory of 4068	1852	omsecor.exe	108
PID 1852 wrote to memory of 4068	1852	omsecor.exe	108
PID 1852 wrote to memory of 4068	1852	omsecor.exe	108
PID 1852 wrote to memory of 4068	1852	omsecor.exe	108
PID 4068 wrote to memory of 3856	4068	omsecor.exe	110
PID 4068 wrote to memory of 3856	4068	omsecor.exe	110
PID 4068 wrote to memory of 3856	4068	omsecor.exe	110
PID 3856 wrote to memory of 1948	3856	omsecor.exe	111
PID 3856 wrote to memory of 1948	3856	omsecor.exe	111
PID 3856 wrote to memory of 1948	3856	omsecor.exe	111
PID 3856 wrote to memory of 1948	3856	omsecor.exe	111
PID 3856 wrote to memory of 1948	3856	omsecor.exe	111

C:\Users\Admin\AppData\Local\Temp\0510b753c81390d1e63e76eccc36ded0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0510b753c81390d1e63e76eccc36ded0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\0510b753c81390d1e63e76eccc36ded0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\0510b753c81390d1e63e76eccc36ded0_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1852
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:1948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 268
        8⤵
        Program crash
        
        PID:1412
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 292
        6⤵
        Program crash
        
        PID:3176
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 300
      4⤵
      Program crash
      PID:3152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 288
  2⤵
  - Program crash
  PID:1148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1700 -ip 1700
1⤵
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3976 -ip 3976
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1852 -ip 1852
1⤵
PID:736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3856 -ip 3856
1⤵
PID:4444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 9f507c7d2eb9008530790f1966945013b3bce1c3e4d8566803abc623ba1d9032
MD5 ed75313d11d12ea7208b5c6badac3f40
SHA1 b754798e9fef2b0efa4c797edead2dedc2e5455f
SHA512 25605235315dd0fca28f7cc1b965440cebbbbbc15ff7a8f9c22fb777dda08a1768621c0941015bc20264afbe9ad1cba7df7f6fab31e8b8826f9c1e152e6ff08c
SSDEEP 1536:QDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:GiRTeH0NqAW6J6f1tqF6dngNmaZC7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 0f5cd4008245bcc18702d3fcd1639c242d72c227d6ca27d22b183204282a86c1
MD5 79305c6278cacc96ae78236013deecf6
SHA1 da1e324b07aacec45612af38845241d69d11b1d1
SHA512 1afe9a9e3623812d5026a783aa8abb094ef619107777b8d207631b24980f3341c44613a682b2c72ac2f5153ade89663d3e92f50ae9b10962e97af0358b2a415b
SSDEEP 1536:UDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:qiRTeH0NqAW6J6f1tqF6dngNmaZC7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 134KB
SHA256 b2b2cf0bd07c4b86f4d3b1a9c2da1adcec2d3735b8ead0ba4b0d6fdac2e3ef94
MD5 889e60bd3f900e333efc7c792e4b55df
SHA1 16c002a942289a8f1828c36e6d9c9e72fb944082
SHA512 1b0c30a56be58a0beef9cd0f5ed3feef418faf1b80be7a5a8e6e6fc5faa4eaffcc4da7057cd937939d817c6c3f9b2f72a59b227902f1ecf3148baf006b48a5b4
SSDEEP 1536:kDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:6iRTeH0NqAW6J6f1tqF6dngNmaZC7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1700-16-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1700-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1852-31-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1852-48-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1948-47-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1948-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1948-52-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1948-46-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2396-7-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2396-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2396-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2396-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3856-42-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3976-11-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4068-39-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4068-34-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4068-35-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5112-28-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5112-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5112-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5112-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5112-17-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5112-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5112-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads