neconyd | 2d9a604456289852b192657d4da7548d8f419007526bbe2909f22e9a35e42390

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 02:32

Target
2fc24de613012dca66bcb65e899294a0_NeikiAnalytics.exe
Size 72KB
Sample240529-c1bbdafh69
SHA256 2d9a604456289852b192657d4da7548d8f419007526bbe2909f22e9a35e42390
MD5 2fc24de613012dca66bcb65e899294a0
SHA1 bbfecd62a848fa9686f5fa15a1f8447b93f63c3c
SHA512 dce6e07ec857256b01a042d394b51fbc5826835e2afdccc8813c981ade7c1bc5bbf3a45b3d7b3fb39d3c9c3a02a8976ffeb94f53f063c021e4f6aeda9face69d
SSDEEP 1536:6d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:adseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
1160	omsecor.exe
4472	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1160	1600	2fc24de613012dca66bcb65e899294a0_NeikiAnalytics.exe	92
PID 1600 wrote to memory of 1160	1600	2fc24de613012dca66bcb65e899294a0_NeikiAnalytics.exe	92
PID 1600 wrote to memory of 1160	1600	2fc24de613012dca66bcb65e899294a0_NeikiAnalytics.exe	92
PID 1160 wrote to memory of 4472	1160	omsecor.exe	102
PID 1160 wrote to memory of 4472	1160	omsecor.exe	102
PID 1160 wrote to memory of 4472	1160	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\2fc24de613012dca66bcb65e899294a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2fc24de613012dca66bcb65e899294a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3768 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:3652

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 65daffbe84db67f87eb189e5cc74fe21ceedefa501431fcc96f33b79d7e798d9
MD5 48d2f35f2be5428c03e0b006888c2309
SHA1 0617d066872456726f18b7604f4ef4185e79fe12
SHA512 618b773f8055b2027eb1432bcddc7902a75aca82294b48258075f5d35f25b917b359bf79dd286630938c58d1295ab947398409539c735f6027e967ceeb18fbba
SSDEEP 1536:Cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:ydseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 72KB
SHA256 9318cc9396c596a191262a47f45198878d8c9c37765dac075d8eef99871812a4
MD5 d7df5785ca1164c446f38a84533253a8
SHA1 6d4d50fa135dcdf6bc2617be09ced7a476b0a654
SHA512 c9e7188a0d5141dafe8e9e5085dd57554675cc270d94aebb7534a0caa2435af130bebd2088bc4da716468244f93aa65df4a023061e54b3b937e5a5dd0792877d
SSDEEP 1536:Fd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:tdseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Submit Download