neconyd | a7d2fa2ac464cada905a951fbf287de9e8fc8253a7cdcc44390ba520da565e89

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 20:35

Target

18e654b9e79a3185fa2288dfc4f9f090NeikiAnalytics.exe
Size

89KB
MD5

18e654b9e79a3185fa2288dfc4f9f090
SHA1

057a40424cd41a1698f89d2364cb3df714431f85
SHA256

a7d2fa2ac464cada905a951fbf287de9e8fc8253a7cdcc44390ba520da565e89
SHA512

ba96395c93fc429b773ad557c9c04063b427380731765a7a1ee7453be38fe7a4e050a5d05a9b567ea92c3e573df592c96d337e96e0235a4ce8dc505d11f96159
SSDEEP

768:fMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:fbIvYvZEyFKF6N4yS+AQmZTl/5

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Executes dropped EXE 3 IoCs

Loads dropped DLL 6 IoCs

pid	Process
2180	18e654b9e79a3185fa2288dfc4f9f090NeikiAnalytics.exe
2180	18e654b9e79a3185fa2288dfc4f9f090NeikiAnalytics.exe
2384	omsecor.exe
2384	omsecor.exe
1700	omsecor.exe
1700	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2384	2180	18e654b9e79a3185fa2288dfc4f9f090NeikiAnalytics.exe	28
PID 2180 wrote to memory of 2384	2180	18e654b9e79a3185fa2288dfc4f9f090NeikiAnalytics.exe	28
PID 2180 wrote to memory of 2384	2180	18e654b9e79a3185fa2288dfc4f9f090NeikiAnalytics.exe	28
PID 2180 wrote to memory of 2384	2180	18e654b9e79a3185fa2288dfc4f9f090NeikiAnalytics.exe	28
PID 2384 wrote to memory of 1700	2384	omsecor.exe	32
PID 2384 wrote to memory of 1700	2384	omsecor.exe	32
PID 2384 wrote to memory of 1700	2384	omsecor.exe	32
PID 2384 wrote to memory of 1700	2384	omsecor.exe	32
PID 1700 wrote to memory of 316	1700	omsecor.exe	33
PID 1700 wrote to memory of 316	1700	omsecor.exe	33
PID 1700 wrote to memory of 316	1700	omsecor.exe	33
PID 1700 wrote to memory of 316	1700	omsecor.exe	33

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
89KB

MD5
e99f3a778977b90d70ab4273ed60c751

SHA1
7dad76fc9cc3624aada8d885a35d87c951ab598b

SHA256
da216a52ffd7aef1e7359965957796d791ff46d00b4258d0d900f98fed183155

SHA512
c5b92c5bdacc864455d31f9077498e9a20ca3f03acb9a6642f2087b45628d6079c5e4395bd9f113a1d14600174a4a90700d6d9b6e444de20d8b56e8fd2233890

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
89KB

MD5
36daab2f45dc65c00a93042a6d50daa8

SHA1
83f8d2ecad21499cc2d9ae5f4e82167664793685

SHA256
8ab47d7ac3f99b7a6da9fb28c8d3848833150f5ea383801ef1492b3ac6d404c6

SHA512
95c85bd556951a61bf766d161b9d333c3d504cd87c98d3979eb051ea692e124c3e86aab6d000316fd449e54bbd46d3e10d9eaae3f80a7645fd45f0bba171716f

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
89KB

MD5
10efc510c00d667d5c2622ae5360f4a9

SHA1
b2b481d6d59ab0e4e94af7122efabcb3b3472656

SHA256
694a87f0bae334e91dc3c39fa640b2b34c907f17cf46f73a3ba4a2dd7fe644da

SHA512
19c9b5948c99aea44179143bdd81e66674b231befdbcf337fc42c1d823b5e2444ad1f33f91cb6adfc8bf5d2b9a12696f0779c3a21b2afb055cd52048bbaf014f

Download Submit