neconyd | a7d2fa2ac464cada905a951fbf287de9e8fc8253a7cdcc44390ba520da565e89

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 20:35

Target

18e654b9e79a3185fa2288dfc4f9f090NeikiAnalytics.exe
Size

89KB
MD5

18e654b9e79a3185fa2288dfc4f9f090
SHA1

057a40424cd41a1698f89d2364cb3df714431f85
SHA256

a7d2fa2ac464cada905a951fbf287de9e8fc8253a7cdcc44390ba520da565e89
SHA512

ba96395c93fc429b773ad557c9c04063b427380731765a7a1ee7453be38fe7a4e050a5d05a9b567ea92c3e573df592c96d337e96e0235a4ce8dc505d11f96159
SSDEEP

768:fMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:fbIvYvZEyFKF6N4yS+AQmZTl/5

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Executes dropped EXE 2 IoCs

pid	Process
3868	omsecor.exe
4416	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 3868	2196	18e654b9e79a3185fa2288dfc4f9f090NeikiAnalytics.exe	91
PID 2196 wrote to memory of 3868	2196	18e654b9e79a3185fa2288dfc4f9f090NeikiAnalytics.exe	91
PID 2196 wrote to memory of 3868	2196	18e654b9e79a3185fa2288dfc4f9f090NeikiAnalytics.exe	91
PID 3868 wrote to memory of 4416	3868	omsecor.exe	101
PID 3868 wrote to memory of 4416	3868	omsecor.exe	101
PID 3868 wrote to memory of 4416	3868	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\18e654b9e79a3185fa2288dfc4f9f090NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\18e654b9e79a3185fa2288dfc4f9f090NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:3864

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
89KB

MD5
36daab2f45dc65c00a93042a6d50daa8

SHA1
83f8d2ecad21499cc2d9ae5f4e82167664793685

SHA256
8ab47d7ac3f99b7a6da9fb28c8d3848833150f5ea383801ef1492b3ac6d404c6

SHA512
95c85bd556951a61bf766d161b9d333c3d504cd87c98d3979eb051ea692e124c3e86aab6d000316fd449e54bbd46d3e10d9eaae3f80a7645fd45f0bba171716f

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
89KB

MD5
4196f1be105d464f965be517d3cc870b

SHA1
9aa8ca0f1d47649b7cfca6e9727e7a8c58b2f74b

SHA256
b4c1242fb2202606e694df4f5273e2498db0c2038b94c455665d733495acd553

SHA512
d0fc47221a24c7932773fccd9fe3121ba979b98742fd76bb41d8400b43808242e6325086070d580022a04abf102d1c60b333921f3e05a74f6547855f0e7554ab

Download Submit