neconyd | d665ea8dc3fe79f03396cc10129910aa36d6dc3ca2c9dcccfeea0517b334ec85

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2e79d1c0e2ab8c077983f8c37fefe840_NeikiAnalytics.exe
Size 35KB
Sample240529-cvpltaeg7z
SHA256 d665ea8dc3fe79f03396cc10129910aa36d6dc3ca2c9dcccfeea0517b334ec85
MD5 2e79d1c0e2ab8c077983f8c37fefe840
SHA1 2de7e9bb88cf63527a208b19c4270d403692b1c1
SHA512 2eb78549e9f251a8949130dafbe65c0efcf1bfd54bc64f557a7ce10dff2440634eb14b5e67ad5011a52566a02d5d4ff0c593c89734445a7c7961fa1e8e789502
SSDEEP 768:16vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:48Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1864	omsecor.exe
1940	omsecor.exe
1692	omsecor.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1044-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1044-4-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x0009000000023387-3.dat	upx
behavioral2/memory/1864-5-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1864-7-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1864-10-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1864-13-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1864-14-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x0008000000023411-17.dat	upx
behavioral2/memory/1864-20-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1940-21-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1940-25-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x0009000000023387-26.dat	upx
behavioral2/memory/1692-27-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1692-29-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1692-32-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1864	1044	2e79d1c0e2ab8c077983f8c37fefe840_NeikiAnalytics.exe	85
PID 1044 wrote to memory of 1864	1044	2e79d1c0e2ab8c077983f8c37fefe840_NeikiAnalytics.exe	85
PID 1044 wrote to memory of 1864	1044	2e79d1c0e2ab8c077983f8c37fefe840_NeikiAnalytics.exe	85
PID 1864 wrote to memory of 1940	1864	omsecor.exe	95
PID 1864 wrote to memory of 1940	1864	omsecor.exe	95
PID 1864 wrote to memory of 1940	1864	omsecor.exe	95
PID 1940 wrote to memory of 1692	1940	omsecor.exe	96
PID 1940 wrote to memory of 1692	1940	omsecor.exe	96
PID 1940 wrote to memory of 1692	1940	omsecor.exe	96

C:\Users\Admin\AppData\Local\Temp\2e79d1c0e2ab8c077983f8c37fefe840_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2e79d1c0e2ab8c077983f8c37fefe840_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 8ed414788e3bae1a13586fa0be406ab0a6ead4daa469986545f3f2e3732b4d14
MD5 a8d3efb7ce2c9cd841d02ab47a09c539
SHA1 64c3447c51b5acff7ccc844c3f2b408dd609a042
SHA512 d8f58b4373779e85a4aa1ea766099bb8bcdff715bf85de7b937d07085feb9544541294120d70c627d4ba95139b1f55f6d854dc0ac2b397a95559ffcfe4705cf4
SSDEEP 768:f6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:i8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 9002aa610d0fe824f52c30db827bf4446bdee319f79c54b15231fda6e24daa90
MD5 4c1a1df58acd496e7a344be70123f488
SHA1 e2b65fe736073deca5bd8bbf3144a9d7dfb07813
SHA512 9c27a20aced1c05dd5e6267422d375b663174f799d855ca7603e7e91d416a2b301c9d7dd06230d66a65b08151fae692636f9e3c77638d2e0b7f1f04c9f90afa7
SSDEEP 768:C6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:x8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 35KB
SHA256 c23fad359e01a9ace18696d325dca699e95b7e084e105c1d807f7636adc81dda
MD5 0b85c8d4a369c9d1b4c1ba1ce9d925a3
SHA1 6baa93163725eb653bb32e28933acd1bcde3d064
SHA512 8748a06cf843c68a2d4c7b9032e41a426c6b6bf245e7f4b9e14e0ea43d8321e71dc5baec46584b0f5be7f5ad1f62dbd15d994f253fbc6e3ad43088a96bf9edd4
SSDEEP 768:r6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:W8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1044-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1044-4-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1692-32-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1692-29-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1692-27-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1864-13-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1864-20-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1864-14-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1864-5-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1864-10-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1864-7-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1940-21-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1940-25-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads