neconyd | 45cfbdb4517157ec699b96055ec5a3fe4e3574c1fd75143596b17c80b1acf22a

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 23:24

Target
5a3e1434483d3bb9e9d0341deb902ac0_NeikiAnalytics.exe
Size 89KB
Sample240529-3dv1daeg67
SHA256 45cfbdb4517157ec699b96055ec5a3fe4e3574c1fd75143596b17c80b1acf22a
MD5 5a3e1434483d3bb9e9d0341deb902ac0
SHA1 fd5be05460184ca3a0421242a590f85f253c4cd2
SHA512 52bb5287f0dff9b1a8f34362a6b93353c5e2d020803ef279e5764dbb23f72e698789257b4622903189a54ac6afbaf13bc34cf5ed4991f9cdb549ad8ec0b81423
SSDEEP 768:ZMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:ZbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
4200	omsecor.exe
2712	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4200	2816	5a3e1434483d3bb9e9d0341deb902ac0_NeikiAnalytics.exe	85
PID 2816 wrote to memory of 4200	2816	5a3e1434483d3bb9e9d0341deb902ac0_NeikiAnalytics.exe	85
PID 2816 wrote to memory of 4200	2816	5a3e1434483d3bb9e9d0341deb902ac0_NeikiAnalytics.exe	85
PID 4200 wrote to memory of 2712	4200	omsecor.exe	103
PID 4200 wrote to memory of 2712	4200	omsecor.exe	103
PID 4200 wrote to memory of 2712	4200	omsecor.exe	103

C:\Users\Admin\AppData\Local\Temp\5a3e1434483d3bb9e9d0341deb902ac0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5a3e1434483d3bb9e9d0341deb902ac0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:2712

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 89KB
SHA256 324acfa5e754e4e944155a11faea82cd52c57675bf449c88852997a88ce28306
MD5 f88edbd178c42cb133914989c457813d
SHA1 668f2410006e540b0bae52ce8280f5a72a47c76a
SHA512 5da474dbfd91b903fd3c69944a6280e7f6d0485fd4b46409456f18ad24b841d1343598ee64782eb07c061e4411173e4d6785ddfbe5b0f5277e86e93206fee924
SSDEEP 768:2MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:2bIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 89KB
SHA256 1e9e4f783d11dd696da337e3b9d4512b4f16ac37f63b3fa7ad0ff4fbf84ee097
MD5 edd4eb88150a2a8d7173a431db2e828d
SHA1 0066d7bc0f16f7d3c68ad6c7e088dd0fd5f1d419
SHA512 b56eef7f700c3561a81a56b77d5b0c25b1248f217147c912d79afccca93686a02defef4c1a26916c36ae66536571c6724934584a29a67058bc6d69dcca62b0a4
SSDEEP 768:UMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:UbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download