neconyd | 446737b19a8f84a7f35f0696cd30122a9abef1fdd917dfb0960fc653b2fc02d2

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 10:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3fe446abdc64d03566245005aa72d1f0_NeikiAnalytics.exe
Size 76KB
Sample240528-mrgf5sha33
SHA256 446737b19a8f84a7f35f0696cd30122a9abef1fdd917dfb0960fc653b2fc02d2
MD5 3fe446abdc64d03566245005aa72d1f0
SHA1 aa2552b5e4c5b01efd28ef3f451c06a8deca8f49
SHA512 479c1b8b59ae01365894de0f4b5015e008c46bca7d36117e0c9ad9c128e927c74a105e992909a0de53b777830e8e186dd03584047a378be8ec25bc5a1900c7de
SSDEEP 1536:0d9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:MdseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
1900	omsecor.exe
2676	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 1900	2872	3fe446abdc64d03566245005aa72d1f0_NeikiAnalytics.exe	84
PID 2872 wrote to memory of 1900	2872	3fe446abdc64d03566245005aa72d1f0_NeikiAnalytics.exe	84
PID 2872 wrote to memory of 1900	2872	3fe446abdc64d03566245005aa72d1f0_NeikiAnalytics.exe	84
PID 1900 wrote to memory of 2676	1900	omsecor.exe	94
PID 1900 wrote to memory of 2676	1900	omsecor.exe	94
PID 1900 wrote to memory of 2676	1900	omsecor.exe	94

C:\Users\Admin\AppData\Local\Temp\3fe446abdc64d03566245005aa72d1f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3fe446abdc64d03566245005aa72d1f0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:2676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 58b2424200c41b6e6755af08472ab4bf4ab2c709ae648f23b6d6ce75e8994f06
MD5 3f3f2bd2bfce2a925d6b6ed5f3cdfac5
SHA1 08f6fff9a27aaa26c1b7f2d2db50ce3cacd94bdd
SHA512 74063d4f07e2059bd873018cd8466e515dfac87c295dab7034b304a719d0c7dd51788877c5de1373f7768d77b163764c60b5455551cfae7c78b0193d8f082931
SSDEEP 1536:wd9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:wdseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 623d2ed391e5fdfcd60d89a80ca1aa093868c3bfac974dca56ef62d4f5b28515
MD5 3ac5408dfd10f38fcac44b2c368fbdb0
SHA1 abeeb165cda69ee62f7910000848518271b0b25d
SHA512 7163cebeae73e6856f019cb47cfdc8a4700cb84f39e390cbb4e3af65c93dfcc8fbf390f586da1539fd0c508683e346fb85ca7473b206199dacd7883385944d2d
SSDEEP 1536:zd9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:zdseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1900-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1900-6-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1900-12-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2676-11-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2676-13-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2872-1-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads