neconyd | 5dbe86fa113b03bbd82449ca5c8aceed9c97acc45cffeef76f99d85f3fac2624

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
631b33338a031815d5052c3e8bb2fbd0_NeikiAnalytics.exe
Size 65KB
Sample240530-ec3f3aed35
SHA256 5dbe86fa113b03bbd82449ca5c8aceed9c97acc45cffeef76f99d85f3fac2624
MD5 631b33338a031815d5052c3e8bb2fbd0
SHA1 f26123ba3b6d00b0ad0b40413f08c9a28f67fa28
SHA512 d92755b4a76565424111f1b1b8e9f00a30fdb577a1d12672bac062fd5a3a5b729ee94cf0ac5729f9073cd91070d6eda6e59d6c80d729fcbe0de6aab57f82bb10
SSDEEP 1536:Cd9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZcl/5:ydseIO+EZEyFjEOFqTiQmOl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4368	omsecor.exe
2780	omsecor.exe
964	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 4368	3924	631b33338a031815d5052c3e8bb2fbd0_NeikiAnalytics.exe	83
PID 3924 wrote to memory of 4368	3924	631b33338a031815d5052c3e8bb2fbd0_NeikiAnalytics.exe	83
PID 3924 wrote to memory of 4368	3924	631b33338a031815d5052c3e8bb2fbd0_NeikiAnalytics.exe	83
PID 4368 wrote to memory of 2780	4368	omsecor.exe	101
PID 4368 wrote to memory of 2780	4368	omsecor.exe	101
PID 4368 wrote to memory of 2780	4368	omsecor.exe	101
PID 2780 wrote to memory of 964	2780	omsecor.exe	102
PID 2780 wrote to memory of 964	2780	omsecor.exe	102
PID 2780 wrote to memory of 964	2780	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\631b33338a031815d5052c3e8bb2fbd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\631b33338a031815d5052c3e8bb2fbd0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 65KB
SHA256 83d9dec8c51936764b4ca71d26de38056dedaa280d6d24544ca7e820261ce5b1
MD5 4abd29e7963c91f316cc76536eee629e
SHA1 6a120fef73f6d6d857111d9049252ab838c0690d
SHA512 be358ef335207dfe3048627190b7441f63d1057fd27f751a5a724343c3a7b38d711ab0eb75dc5843b337bba7ed36bc1d218c1a1c482518685ff0a5ed26345c91
SSDEEP 1536:ud9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZcl/5:2dseIO+EZEyFjEOFqTiQmOl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 65KB
SHA256 6309b7887aa33d3f42363c60823548281c7e834c1f1ebea19a4c3bb2067eccfc
MD5 d204ebf1ed114df4acce2f099cdc4583
SHA1 d518214123b61529cf75242e2765b756202d156d
SHA512 21d61ec42496f480218f54cc215f392f4ef6758f18b46e1fa51cc89d5e35ae59948371a8e2710605231f2c40f60f837cc125a9ec82cedec31692d0acdfcc5fb4
SSDEEP 1536:md9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZcl/5:edseIO+EZEyFjEOFqTiQmOl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 65KB
SHA256 5a5b61c2c3328d9f323dda552cc0a4a8bc0a11eedecc7f84780fc78dd5d1692b
MD5 a8d5085885c4f4f3580f04ee556f7e75
SHA1 9b155ab7d11d91e12b018ee3a4cc9f5a43a92479
SHA512 fad6e84de002c1431600225c2f125f2392ab9d19f433d59b49dfaad4fd552a4f3a296f479bef2be6bd8d34973025c15300a4f0467e02cdbe36e4700f1cd1a978
SSDEEP 1536:6d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZcl/5:adseIO+EZEyFjEOFqTiQmOl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/964-18-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/964-20-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2780-13-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2780-17-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3924-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3924-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4368-6-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4368-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4368-11-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads