neconyd | 1b40a39152a8a169b3f67053a50154aa962655f4e56c399ed0b8bdeb401072ff

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 06:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7c5fee91d69c90d980ec44a844da4a50_NeikiAnalytics.exe
Size 61KB
Sample240526-g72jcsag44
SHA256 1b40a39152a8a169b3f67053a50154aa962655f4e56c399ed0b8bdeb401072ff
MD5 7c5fee91d69c90d980ec44a844da4a50
SHA1 7383c40e805166d681ed833e13010713c749a24f
SHA512 6589fb437779359aa8d469b4958bbcda43f9da75938672c8c0481638af00ccb65193a8570c5b64fcac1ba9615c1b378cac569ed8eef17cd8a1700fc0af7c96bb
SSDEEP 1536:Cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZ/l/5:ydseIOMEZEyFjEOFqTiQmll/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1664	omsecor.exe
632	omsecor.exe
884	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 1664	3240	7c5fee91d69c90d980ec44a844da4a50_NeikiAnalytics.exe	90
PID 3240 wrote to memory of 1664	3240	7c5fee91d69c90d980ec44a844da4a50_NeikiAnalytics.exe	90
PID 3240 wrote to memory of 1664	3240	7c5fee91d69c90d980ec44a844da4a50_NeikiAnalytics.exe	90
PID 1664 wrote to memory of 632	1664	omsecor.exe	107
PID 1664 wrote to memory of 632	1664	omsecor.exe	107
PID 1664 wrote to memory of 632	1664	omsecor.exe	107
PID 632 wrote to memory of 884	632	omsecor.exe	108
PID 632 wrote to memory of 884	632	omsecor.exe	108
PID 632 wrote to memory of 884	632	omsecor.exe	108

C:\Users\Admin\AppData\Local\Temp\7c5fee91d69c90d980ec44a844da4a50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7c5fee91d69c90d980ec44a844da4a50_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4744,i,15142778360084620907,1763097090506261076,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
1⤵
PID:1872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 95f7e9e7b647d87271783a351cf4ac863110c439d53738a85dc0e6cfb599008c
MD5 7617b4204ca6a44518a47d62550453b3
SHA1 f06c15ba12fefeaa3314b16efe876a6b4a6f2ed0
SHA512 1f4a3c916cefcfc06a033772d50eff14d7659bdd25be82f3ecaf35925a9e651ff76345e5e3b3fc5c005c0d40d6e0bc0bbf5a5842a30c603d68d3d41049dd5206
SSDEEP 1536:rd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZ/l/5:bdseIOMEZEyFjEOFqTiQmll/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 3fc258ace2a2179840ecb8ac13147f28d560d27316b3b00a02caeba3df1a6f55
MD5 0a6d7a4888d488fba711ae147aee4cce
SHA1 dd646ad55d1dd7cef09bef7d75a314053254e66a
SHA512 09ead02baf030a2c46fb74f5e19d36349f8d7a9bf3dbb7e65a477d4023cca82a847dde4c3158df0dd9a19a6e15c91a86d8914b585fb93a0b26f738fed32102d7
SSDEEP 1536:Hd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZ/l/5:vdseIOMEZEyFjEOFqTiQmll/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 61KB
SHA256 2f396b187eb598a8e706bdd0f087355b5a45a0d3c7d4a72f4f70ca33f086e2b0
MD5 54c203b9cfce35425beed9c2dc6ff290
SHA1 e36b774f9a3544382fb4c624a47eefee12a790e5
SHA512 f1a13a9d83c51fdf0a7f01d52bb75e03fa8bd4f1284426a7745ebb220548556a0ec45fd3b53807e2b6d7f8a69febda53e584dfa84c025dd4d7766fd4bc190d57
SSDEEP 1536:rd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZ/l/5:bdseIOMEZEyFjEOFqTiQmll/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads