neconyd | e5d26d1abffdf7ad78ed2aba70c1c036a511d92908aa555795b6938d2c7b4186

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c573909d0b857332e87af1d02b51fc0_NeikiAnalytics.exe
Size 76KB
Sample240531-t64njsfa33
SHA256 e5d26d1abffdf7ad78ed2aba70c1c036a511d92908aa555795b6938d2c7b4186
MD5 2c573909d0b857332e87af1d02b51fc0
SHA1 fdd08bc3bf66c2257af41e25a90628e7752e3011
SHA512 5454d55e77153e02668dce50377aaef51c70de8bf53693495b2177288ada655b3f0f846900652c8feff32bb95addb40814cea350ef843b2d282f780a9c7a17a6
SSDEEP 1536:3d9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:/dseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
3252	omsecor.exe
3832	omsecor.exe
2536	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 3252	4868	2c573909d0b857332e87af1d02b51fc0_NeikiAnalytics.exe	81
PID 4868 wrote to memory of 3252	4868	2c573909d0b857332e87af1d02b51fc0_NeikiAnalytics.exe	81
PID 4868 wrote to memory of 3252	4868	2c573909d0b857332e87af1d02b51fc0_NeikiAnalytics.exe	81
PID 3252 wrote to memory of 3832	3252	omsecor.exe	93
PID 3252 wrote to memory of 3832	3252	omsecor.exe	93
PID 3252 wrote to memory of 3832	3252	omsecor.exe	93
PID 3832 wrote to memory of 2536	3832	omsecor.exe	94
PID 3832 wrote to memory of 2536	3832	omsecor.exe	94
PID 3832 wrote to memory of 2536	3832	omsecor.exe	94

C:\Users\Admin\AppData\Local\Temp\2c573909d0b857332e87af1d02b51fc0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2c573909d0b857332e87af1d02b51fc0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3832
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 f25b2efa2ec6f3e185657d3cc67940230da6312483e028d4771e7c6a6ed66006
MD5 75edbf48d7846d47d1967a3312f4f78b
SHA1 3e22b4890b469675220acb7fcaefa266cc91b627
SHA512 7360abc142797bcb41a15f06eaa4716c3b7a9db1486eee079ad531e1dce7d3d25ee13d9d14fb92bd6c54727149f5e9f2802b34ba7651d17d805d61248536a6ad
SSDEEP 1536:zd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:zdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 4205c0edc2129bbfa71847654e6422ce75b386fc77e452db6c203a48bb2fe647
MD5 f992640494bd4362766c96fbb07e5cba
SHA1 04470c1924c45d124036218d7a5fcefbdf2b039e
SHA512 b78f28f9122cd02f4a4f79ac80e7922f4c3e312d8bb2b7758a670249a4786d47b9495ac48e2a5aa754b85ffc5b7f76eff3f7b124151665e50279f09e17ed8c0b
SSDEEP 1536:vd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:HdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 8ca7c4568d137cb0260fbd92091e1b69613464a306d670a55366b7d23c7766ba
MD5 603090c6539a7cd630acb4654d054f62
SHA1 dd90839e2c25ddab538f1af149cdb649c7e66c3d
SHA512 93cab1fa47c37d73b1f99a791708c2a30da76e8f956a34759a4f979c8dad3d5316a402017703371f7602215afbb030de32f2c43c91383faa714f5c0a5ea34c09
SSDEEP 1536:rd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:bdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2536-18-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2536-20-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3252-6-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3252-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3252-11-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3832-13-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3832-16-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4868-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4868-4-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads