neconyd | c88bce2d2c2293386078b8392b81e71ba732eedd3154c9b94f31ffca634ae7de

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5f58820a6238f60d7c62e26960f20ba0_NeikiAnalytics.exe
Size 72KB
Sample240530-b9j47sbb97
SHA256 c88bce2d2c2293386078b8392b81e71ba732eedd3154c9b94f31ffca634ae7de
MD5 5f58820a6238f60d7c62e26960f20ba0
SHA1 489cb62f31265e1df29fbfda4a754206cff6a0c8
SHA512 165cfbd2d93f18bfbd2c7b461116aa77ac5dca9fac3012a64ddbdf4bc5b20b9f2b3f1f01f039ac2cb67c66cf2b4a675cb0f63484ca6337b4d47c5239fda37358
SSDEEP 1536:6d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:adseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
60	omsecor.exe
4512	omsecor.exe
3952	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 60	228	5f58820a6238f60d7c62e26960f20ba0_NeikiAnalytics.exe	83
PID 228 wrote to memory of 60	228	5f58820a6238f60d7c62e26960f20ba0_NeikiAnalytics.exe	83
PID 228 wrote to memory of 60	228	5f58820a6238f60d7c62e26960f20ba0_NeikiAnalytics.exe	83
PID 60 wrote to memory of 4512	60	omsecor.exe	100
PID 60 wrote to memory of 4512	60	omsecor.exe	100
PID 60 wrote to memory of 4512	60	omsecor.exe	100
PID 4512 wrote to memory of 3952	4512	omsecor.exe	101
PID 4512 wrote to memory of 3952	4512	omsecor.exe	101
PID 4512 wrote to memory of 3952	4512	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\5f58820a6238f60d7c62e26960f20ba0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5f58820a6238f60d7c62e26960f20ba0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:228
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 1fca589f6fce4b03f455b6e65fe9d265876045f73e2fea3126488d3554c07dba
MD5 4936872420c26124b0f99270bf5d335c
SHA1 aa9c1fa3406e71f029dd8b088d8210b032ef5b94
SHA512 9c4b86e9c50787136eb94ef05cdd8ed8c9b97c1a023f90291966e0852526447cddb15f7e82ddf43cf0f7fc478888060f245554d5066b919459508a2ba2f3eefa
SSDEEP 1536:Ed9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:8dseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 42f244d052c40a2d6e969cc79e16a5099c7cb109c3063560fb830d02ccda3e4a
MD5 8c6c4b2d035bd3158c7984b29051183b
SHA1 8c5e2d3ea3f559cadd9550da0c58f78336e9b5d0
SHA512 c16f538dd1ac8df94b33e6aed9d30978b178a5150e7b91142b3d406aa845c6e9d8f785181feb820a1bca26948990cd90a9c9cad00f5c58661e2ba5808622acf8
SSDEEP 1536:Ld9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:7dseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 72KB
SHA256 2dcfff7d2af13ddce754a6a1b1f259441d0ad89e9d0be51da41e1cf707fe8854
MD5 1e88b3afd9106f907db825ac52eda25a
SHA1 a4e25a6233329a7939531522e3f9a9fb2f28f0e7
SHA512 06758263d5c0ba170a071fa7b37ddf5953d200d61893da2060a886b1075480578fe170cdfc5b30b2b5fa5bb112516c09f90a316a4d45210458acf9c7e3448dfe
SSDEEP 1536:Ad9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:gdseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads