neconyd | 396f1dfa4bdc76b5e470985f9388cc346be8bb33b835a6329e08fddcb27546af

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b6578b6eb37ab937eba9f840053e8340_NeikiAnalytics.exe
Size 84KB
Sample240531-vbk4dsed8v
SHA256 396f1dfa4bdc76b5e470985f9388cc346be8bb33b835a6329e08fddcb27546af
MD5 b6578b6eb37ab937eba9f840053e8340
SHA1 249393fe2c305d1e6bf598ac1ad87e9ff7ca197f
SHA512 61d269b0db0286055298fed44a30e4e3f74304c9a140128b6a82cafddc9c1a2910490de2cc115f957f2859b0527eb165a8eb80fe6d369f55c7d98fdbb195fb8b
SSDEEP 768:PMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:PbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
932	omsecor.exe
3548	omsecor.exe
4500	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 932	4800	b6578b6eb37ab937eba9f840053e8340_NeikiAnalytics.exe	82
PID 4800 wrote to memory of 932	4800	b6578b6eb37ab937eba9f840053e8340_NeikiAnalytics.exe	82
PID 4800 wrote to memory of 932	4800	b6578b6eb37ab937eba9f840053e8340_NeikiAnalytics.exe	82
PID 932 wrote to memory of 3548	932	omsecor.exe	95
PID 932 wrote to memory of 3548	932	omsecor.exe	95
PID 932 wrote to memory of 3548	932	omsecor.exe	95
PID 3548 wrote to memory of 4500	3548	omsecor.exe	96
PID 3548 wrote to memory of 4500	3548	omsecor.exe	96
PID 3548 wrote to memory of 4500	3548	omsecor.exe	96

C:\Users\Admin\AppData\Local\Temp\b6578b6eb37ab937eba9f840053e8340_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b6578b6eb37ab937eba9f840053e8340_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 6f1533da660ba05b0538d5d2c04959cf433211e5c265b460529c56a838dd55d4
MD5 8dd3275dcf8b84500eb60683dff3a5e6
SHA1 bd109ff606815ded9ee9e4fcdac706a6d4364b63
SHA512 b3951d8d567f0f6b56ef4770b453ce2ea1563d1a00730672a2d47c11724d80b4586d2189c732f7a14648d6e1c980fe9f4727a6df1b1d3de10e003f70fe0dffab
SSDEEP 768:9MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:9bIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 364565acdaa7dd01017d0059a243c786d849890b1c3f563897f6f2e9a07a730e
MD5 84adb316e9d04eed955ea599b2f0e75e
SHA1 f1ab6f532a4a290e358df1e68203cae659910f30
SHA512 e82ef3a5f18d771b12bc93e2b7242b52c37fc9ec29acc99f672aa361383d5a7ac74ce11fb1836db4ccd46fcf2452699081a3a347419ad7c9e9af88085c023718
SSDEEP 768:3MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:3bIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 e08884970d33ff32832fc7ba3dc2e2af834ed2202fe1f1e59a747f0829260a7c
MD5 dd0c01e784cab9d4fbb19b144a7e17b6
SHA1 26b2d3963765f9b697916581d3734b9007b5f4ee
SHA512 4590c0288d8bc505845a2118ab33fd34c86c90847e47315cbdce734048735822f84d35f1763425e21ba8abdd556bad424b0a38434e1b077f49454d767128ae45
SSDEEP 768:BMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:BbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads