neconyd | aaad61dd0cc1114c7f8ab127451fb709ea415dd2b2478de2ba48a03c0dbd611f

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 10:23

Target
cf625f447c2644c99c14f38e9397ad80_NeikiAnalytics.exe
Size 84KB
Sample240530-mescwafa88
SHA256 aaad61dd0cc1114c7f8ab127451fb709ea415dd2b2478de2ba48a03c0dbd611f
MD5 cf625f447c2644c99c14f38e9397ad80
SHA1 85c3b72c255bf1cede6e464a14ddefaffb2d4cf9
SHA512 e4364b815d6ddc4085f51a0c252a772e9d1fbdc735feec203962476df547c7686b60f265778fc5bdfe8104cd84a9cb6273ade5cb802e683eb7e98cae10b278d8
SSDEEP 1536:fd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:XdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
3832	omsecor.exe
4500	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 3832	1480	cf625f447c2644c99c14f38e9397ad80_NeikiAnalytics.exe	91
PID 1480 wrote to memory of 3832	1480	cf625f447c2644c99c14f38e9397ad80_NeikiAnalytics.exe	91
PID 1480 wrote to memory of 3832	1480	cf625f447c2644c99c14f38e9397ad80_NeikiAnalytics.exe	91
PID 3832 wrote to memory of 4500	3832	omsecor.exe	101
PID 3832 wrote to memory of 4500	3832	omsecor.exe	101
PID 3832 wrote to memory of 4500	3832	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\cf625f447c2644c99c14f38e9397ad80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\cf625f447c2644c99c14f38e9397ad80_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:2264

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 d1080bd1beb78dfc77d8c0cfb35fecac7ee475de133f48cc2729d18841322290
MD5 2481d5be8dc5716ba9216637a1c005e8
SHA1 040ee2163353e15d2da87a8c9e8c737912b92813
SHA512 6cde8d21a99e6a611d83edde2c773f9e72be60549984f0b38510aa3cb36f76fa03e77f1f069aacc7b35274787ca2a26745bec9b44b8d1d5630f07025d32abb43
SSDEEP 1536:Xd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:fdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 00963125196d85963e79d2b4423d1c1260af0d1f249d232837446bcd9e2481e2
MD5 3a0373bf369cd2d4c82091356efa9a6f
SHA1 ab9a28a915b7a5ade625aa59b14773219b372b76
SHA512 555d90e46ab2ce6c1463f3144a2620b801f4779f34d8a439b0012bc01d7285138f049a8fdfe315b75682b85ae12defc5b9fafd2543f7ecfb8cdef9ece19ca857
SSDEEP 1536:Cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:ydseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download