neconyd | dd03c0e08ce79e38eaf44ddb60bfd4b4193c0eac4bb6efdf06e47894dc3455b0

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
16b41d8e3f482a661ec85979f6e16100_NeikiAnalytics.exe
Size 84KB
Sample240527-b7p8fach45
SHA256 dd03c0e08ce79e38eaf44ddb60bfd4b4193c0eac4bb6efdf06e47894dc3455b0
MD5 16b41d8e3f482a661ec85979f6e16100
SHA1 0b5e27eba9bed3eb222fe36eaf1f3d1a6b0a056a
SHA512 0f8ced6d2bc3f2cbbce7996c9c61073bf431e13dc0bacbda475912021e3c544aab29b683907f5c805be4003585963c858f9b856963cc748b42074b9cefd4148f
SSDEEP 1536:Bd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:xdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4660	omsecor.exe
3484	omsecor.exe
800	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 4660	1020	16b41d8e3f482a661ec85979f6e16100_NeikiAnalytics.exe	82
PID 1020 wrote to memory of 4660	1020	16b41d8e3f482a661ec85979f6e16100_NeikiAnalytics.exe	82
PID 1020 wrote to memory of 4660	1020	16b41d8e3f482a661ec85979f6e16100_NeikiAnalytics.exe	82
PID 4660 wrote to memory of 3484	4660	omsecor.exe	91
PID 4660 wrote to memory of 3484	4660	omsecor.exe	91
PID 4660 wrote to memory of 3484	4660	omsecor.exe	91
PID 3484 wrote to memory of 800	3484	omsecor.exe	92
PID 3484 wrote to memory of 800	3484	omsecor.exe	92
PID 3484 wrote to memory of 800	3484	omsecor.exe	92

C:\Users\Admin\AppData\Local\Temp\16b41d8e3f482a661ec85979f6e16100_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\16b41d8e3f482a661ec85979f6e16100_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 f560db3e0bf805179e7036b62dc1f194e655300e9d627fd01be80b08c17aa9e9
MD5 02f5b3e036d914bfa5f5f7b0103714d9
SHA1 a8c605126d08c79b6ffb39c9d502d55dec28787e
SHA512 b723f536ea26fd63f40d12fa3335a45f4fc62269790b83d5499ab4ec88038140baf447fcb29d4a1fc3a5fabbb29be72302546a91b370b7b05d9e473203ce8be4
SSDEEP 1536:Xd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:fdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 023cc5a49f86635fa11b7b8717cb7166b9f333332d1cb22d8e44cc44ce7c9b80
MD5 8a5860a7a834efcb3962e6bc7bd2d9f2
SHA1 7a53e4cce3efaaa1829ab9b3c3573d51cf2ba3f2
SHA512 01511e0365e5407d9e6151e70815475e6a4cc0393b90d9f71d9005be34d19528250953a5131c42d77e677318def62c1f234c0683e9885f289cd3a0cb77a71d63
SSDEEP 1536:Vd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:ddseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 b8365eec5beec54c38974268a00d00130cf302aef961813601f55422faf69c76
MD5 494ce77f4f4826637d86d7aa3e203910
SHA1 4320677316f699be2696c8c795b7f04644fd025c
SHA512 ef0660f708ae74e414e4f420205f84dc372f178a8821dc36ed4c0714e68f279e13b39e6094ebbd3b9e72eebb05edd03b53543e3744b4214657f8038b055664b1
SSDEEP 1536:Wd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:udseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads