neconyd | a7d2fa2ac464cada905a951fbf287de9e8fc8253a7cdcc44390ba520da565e89

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 17:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18e654b9e79a3185fa2288dfc4f9f090_NeikiAnalytics.exe
Size 89KB
Sample240526-v5751sfa48
SHA256 a7d2fa2ac464cada905a951fbf287de9e8fc8253a7cdcc44390ba520da565e89
MD5 18e654b9e79a3185fa2288dfc4f9f090
SHA1 057a40424cd41a1698f89d2364cb3df714431f85
SHA512 ba96395c93fc429b773ad557c9c04063b427380731765a7a1ee7453be38fe7a4e050a5d05a9b567ea92c3e573df592c96d337e96e0235a4ce8dc505d11f96159
SSDEEP 768:fMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:fbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4228	omsecor.exe
1036	omsecor.exe
4908	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 4228	216	18e654b9e79a3185fa2288dfc4f9f090_NeikiAnalytics.exe	84
PID 216 wrote to memory of 4228	216	18e654b9e79a3185fa2288dfc4f9f090_NeikiAnalytics.exe	84
PID 216 wrote to memory of 4228	216	18e654b9e79a3185fa2288dfc4f9f090_NeikiAnalytics.exe	84
PID 4228 wrote to memory of 1036	4228	omsecor.exe	102
PID 4228 wrote to memory of 1036	4228	omsecor.exe	102
PID 4228 wrote to memory of 1036	4228	omsecor.exe	102
PID 1036 wrote to memory of 4908	1036	omsecor.exe	103
PID 1036 wrote to memory of 4908	1036	omsecor.exe	103
PID 1036 wrote to memory of 4908	1036	omsecor.exe	103

C:\Users\Admin\AppData\Local\Temp\18e654b9e79a3185fa2288dfc4f9f090_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\18e654b9e79a3185fa2288dfc4f9f090_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:216
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 89KB
SHA256 1e0b7b55cb5ff5f4ed74fac4eea9f6a9410d12a024e111096f7380a468f81548
MD5 355d7250bbce37f4a139ad37c12ebf74
SHA1 d5b543fca070a930667865f5c9e61b8d33a4b46e
SHA512 b5300af99446f8479dffe9b3137795612e2d94ef09f1f248ae193601279c584e0e3bcc19d50bd75413b517a1da03abe4d89a7b8af8448bcdde820d9032f4944e
SSDEEP 768:0MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:0bIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 89KB
SHA256 8ab47d7ac3f99b7a6da9fb28c8d3848833150f5ea383801ef1492b3ac6d404c6
MD5 36daab2f45dc65c00a93042a6d50daa8
SHA1 83f8d2ecad21499cc2d9ae5f4e82167664793685
SHA512 95c85bd556951a61bf766d161b9d333c3d504cd87c98d3979eb051ea692e124c3e86aab6d000316fd449e54bbd46d3e10d9eaae3f80a7645fd45f0bba171716f
SSDEEP 768:mMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:mbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 89KB
SHA256 0d9e48d7a438eec6c899a687fa4eedbe72d6992869a7f271533e18d4c15693e9
MD5 c1b1722c47f2db0b1e794207b28501cd
SHA1 f4dc343a17332788fe5ad01df194519d1d5f60c2
SHA512 77859fc7ff668548d62cf061d10060502b94ed56365388dca9586ae272e8a598ce4eb4c8543aced8ccb947c5be3c406b2a4cfa6397cf984a0da2d4ca0df45a45
SSDEEP 768:MMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:MbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads