neconyd | 017b283005a0c3bac54fdb7c5b5b4e57c855c92df4b61cb8fc12de9390a15b55

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5fb023120e17dea6df65f2e6be6f3d70_NeikiAnalytics.exe
Size 76KB
Sample240530-cf2b3abe64
SHA256 017b283005a0c3bac54fdb7c5b5b4e57c855c92df4b61cb8fc12de9390a15b55
MD5 5fb023120e17dea6df65f2e6be6f3d70
SHA1 ee893b720b252bc95c147c4eed326fa86313f83a
SHA512 744b2a1cfda1bfe9e5eea459027f7dfbd754c7166640554a3433b6b7077f38c92b0d7fbb085ab9d6222777570ae378fb5ac23aad4c27b1c7e2a0a63645e1cd64
SSDEEP 1536:yd9dseIOcE93dIvYvZEyF4EEOF6N4yS+AQmZTl/5011:CdseIOKEZEyFjEOFqTiQm5l/5011
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4312	omsecor.exe
4032	omsecor.exe
4896	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 4312	4360	5fb023120e17dea6df65f2e6be6f3d70_NeikiAnalytics.exe	83
PID 4360 wrote to memory of 4312	4360	5fb023120e17dea6df65f2e6be6f3d70_NeikiAnalytics.exe	83
PID 4360 wrote to memory of 4312	4360	5fb023120e17dea6df65f2e6be6f3d70_NeikiAnalytics.exe	83
PID 4312 wrote to memory of 4032	4312	omsecor.exe	100
PID 4312 wrote to memory of 4032	4312	omsecor.exe	100
PID 4312 wrote to memory of 4032	4312	omsecor.exe	100
PID 4032 wrote to memory of 4896	4032	omsecor.exe	101
PID 4032 wrote to memory of 4896	4032	omsecor.exe	101
PID 4032 wrote to memory of 4896	4032	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\5fb023120e17dea6df65f2e6be6f3d70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5fb023120e17dea6df65f2e6be6f3d70_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 f00e8a0d174e47891e692f9c11d2746b717826841002884cfe958fc77e9fd65b
MD5 839c5cc18b9e62855a0cbbd57b8865e4
SHA1 127e7ed817e54f16b21b289d6631c88dd5f7a512
SHA512 54b24557428907a3eab1ea0ece8dd28ce30754df4eed7c24c47588bf0e360f99be27e7c1c6389c0356ceeed521b509cb2139a12178ed55fd019cfc7be05c2334
SSDEEP 1536:dd9dseIOcE93dIvYvZEyF4EEOF6N4yS+AQmZTl/5011:VdseIOKEZEyFjEOFqTiQm5l/5011
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 9e20d99634dd592c95c3eee7267731e5adec38ab1de89fb4a1831283e9f8930d
MD5 b78af58b8def986ce72211345ea42846
SHA1 614211efec44b7d8d1dc707baf92f02aad291b1c
SHA512 c0f45cdeb01a5b7646847de0276fd2dd4fd54ed18c5e22fb439b3596b9b83c94117e22b5d2223cbcef2e0136710fb91533d4a22573ae748e5ab1d61f79cd10d0
SSDEEP 1536:id9dseIOcE93dIvYvZEyF4EEOF6N4yS+AQmZTl/5011:SdseIOKEZEyFjEOFqTiQm5l/5011
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 94ba0b1f6edfd18c4a936c1817b64667497c6be4a406ded410d73e026a92ce06
MD5 197cc0a26e0e97e7c4e83d7d9a8e230c
SHA1 cbf65d1d1512bc50e3e4ad9010664d4c38b2099b
SHA512 c642249e742842e241fccabd46b53032a5a6e9ce5a5c361f27fec370e4fc9bebb34e752c56c1d8c839a824d60e8113ac268081c6d2c306309d519de73249ea5e
SSDEEP 1536:pd9dseIOcE93dIvYvZEyF4EEOF6N4yS+AQmZTl/5011:pdseIOKEZEyFjEOFqTiQm5l/5011
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4032-13-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4032-18-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4312-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4312-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4312-11-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4360-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4360-4-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4896-17-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4896-20-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads