neconyd | afe4eada5552c76566e9d29cddce9d2e60b83c231b4b9a19933e15bdb8d70fbe

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1779f9473e6628226fe73e3bd98159b0_NeikiAnalytics.exe
Size 80KB
Sample240528-3ehrfagg4t
SHA256 afe4eada5552c76566e9d29cddce9d2e60b83c231b4b9a19933e15bdb8d70fbe
MD5 1779f9473e6628226fe73e3bd98159b0
SHA1 c83d52aca62de7c847781726d961593419a1dc6f
SHA512 45b9cceaad8b3a028e0e50261881079329c2c30c5b72c565bcfdf53fc44cdff635c88db442996f9d2d72f37c5c8c347025a93260e38e73b8d00f1698fec4d11c
SSDEEP 768:8fMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:8fbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
3224	omsecor.exe
4160	omsecor.exe
3012	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3224	2796	1779f9473e6628226fe73e3bd98159b0_NeikiAnalytics.exe	82
PID 2796 wrote to memory of 3224	2796	1779f9473e6628226fe73e3bd98159b0_NeikiAnalytics.exe	82
PID 2796 wrote to memory of 3224	2796	1779f9473e6628226fe73e3bd98159b0_NeikiAnalytics.exe	82
PID 3224 wrote to memory of 4160	3224	omsecor.exe	99
PID 3224 wrote to memory of 4160	3224	omsecor.exe	99
PID 3224 wrote to memory of 4160	3224	omsecor.exe	99
PID 4160 wrote to memory of 3012	4160	omsecor.exe	100
PID 4160 wrote to memory of 3012	4160	omsecor.exe	100
PID 4160 wrote to memory of 3012	4160	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\1779f9473e6628226fe73e3bd98159b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1779f9473e6628226fe73e3bd98159b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 80KB
SHA256 8a5d4aec11a22fd261e0382293ab14d218ff4d4cb1c5718e49cd431dff4e2742
MD5 0e874f464273bd1749d279ab06cbeca4
SHA1 b85555204a4f6e798cbc469cc3af64b80a4a925a
SHA512 fe4bde21d09f86b3652c81331f75ab41c8878f07c06b13758d15c3947c3a0e6f9bdabeeb8ed716d10108ec04b1e8f226ddab5bd4edaa62f6fd3ae735538f0f74
SSDEEP 768:xfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:xfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 80KB
SHA256 24a3ac02b6099cd0ad9b10bb552e27732674ce5f48d4fa12ee34fdae7d1719c3
MD5 9907b7d355b66ffeb57ab08e270d82f8
SHA1 2354e026401de33df7b0d1551ec1adda6e0bf347
SHA512 a0b5d5603954a7de6ef4f4e224a349e7cc98aba9c917812d8cd3b115667b878f297a5df49ffd9ceb5233cb49f31810e64c424b94da1a1e7c66202b43953ecf69
SSDEEP 768:YfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:YfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 80KB
SHA256 933f40d7b10f316239ba344694ed82ff9f1349d3a97d568ca10bc6bdc7f5c0b8
MD5 06c055b7c34e4c85ac3d58d72842b987
SHA1 bc98e63e9a7760e453a6e317f238d9e51936d2d4
SHA512 1c124bb80a5e1497a00c4ca1e17670e6af02d18079555674a8f1751b77c6e95d53aa2944b2895019639dd64683d442d4ce03223864a70ced04c959caf0baec19
SSDEEP 768:1fMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:1fbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads