neconyd | 4010682cd6dd81deee9597f72e1a92b29968cbfb15f7fb6c25a1f7af19b4be80

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 00:11

Target
1cd06b282b2f53c3e28475bf3c357e30_NeikiAnalytics.exe
Size 88KB
Sample240529-ag2ccabc24
SHA256 4010682cd6dd81deee9597f72e1a92b29968cbfb15f7fb6c25a1f7af19b4be80
MD5 1cd06b282b2f53c3e28475bf3c357e30
SHA1 621897eae91e4580084953a64aa2499761b3c679
SHA512 a7047c6ae909ad224e174a0f3880720763b101d4c0679770cb84ca6ecf7a64b948c096c5b407ceac41c284a2e3448c2415cbd9b26dfa3e0f61f963cad22473be
SSDEEP 1536:nd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:PdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
4872	omsecor.exe
2464	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4872	4508	1cd06b282b2f53c3e28475bf3c357e30_NeikiAnalytics.exe	82
PID 4508 wrote to memory of 4872	4508	1cd06b282b2f53c3e28475bf3c357e30_NeikiAnalytics.exe	82
PID 4508 wrote to memory of 4872	4508	1cd06b282b2f53c3e28475bf3c357e30_NeikiAnalytics.exe	82
PID 4872 wrote to memory of 2464	4872	omsecor.exe	95
PID 4872 wrote to memory of 2464	4872	omsecor.exe	95
PID 4872 wrote to memory of 2464	4872	omsecor.exe	95

C:\Users\Admin\AppData\Local\Temp\1cd06b282b2f53c3e28475bf3c357e30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1cd06b282b2f53c3e28475bf3c357e30_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:2464

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 c91a400f2a21279846a7d1ff9631ea189689f79957fadc764e7fa353daaedc0b
MD5 d83a371cc90a4e07bf3cbdc285941272
SHA1 d67dcbe2d161f090a692c8307ee91bb5295e52fa
SHA512 7cf3cd5bc4602adb74038b818c3633b9720f63436d29ba2823e4167ccde0e001da5fa23c6750672d414a55af491ee72597dd704054827a22dce6ec42311bedfb
SSDEEP 1536:/d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:3dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 692542b69e42715090e14506515cd656c7f49e5ce189e2271bf336b8383feaa1
MD5 7f8e8b772d8e5de6298f749db4ab7b7d
SHA1 b273c264938a9db1f54bd74bcceda0f10b28ade7
SHA512 e2ce0af23f14e1006e213984df7ce916570f2d15afb5ab50b75000f125d7a95c2ead7ed16571f283418a44335a6441b605ca737f77783176eac347480069fcc7
SSDEEP 1536:id9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:SdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download