neconyd | 42e5a6b8fe30cc40ea931e9e26c9801e034795c20f726c77970ef399a8e93cef

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7e34e19f394f5b2d6c02ac4fcace8f10_NeikiAnalytics.exe
Size 35KB
Sample240602-25b6xabf45
SHA256 42e5a6b8fe30cc40ea931e9e26c9801e034795c20f726c77970ef399a8e93cef
MD5 7e34e19f394f5b2d6c02ac4fcace8f10
SHA1 dec030dbd9ca9c8c6ceeb7e86b0169370604b216
SHA512 9682e9ff298d1032029bcedf5b3e6f994adac491c3fd841a6abc948ebe581cdffa565a3cadfaf9a47756704f59573014d7ae29dced8a94f93551d2e2076b3cdb
SSDEEP 768:N6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:A8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1888	omsecor.exe
1904	omsecor.exe
2252	omsecor.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4052-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-3.dat	upx
behavioral2/memory/4052-4-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1888-6-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1888-7-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1888-10-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1888-13-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1888-14-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x000c000000022ac6-17.dat	upx
behavioral2/memory/1888-19-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1904-20-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1904-26-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-24.dat	upx
behavioral2/memory/2252-28-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2252-29-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2252-32-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 1888	4052	7e34e19f394f5b2d6c02ac4fcace8f10_NeikiAnalytics.exe	82
PID 4052 wrote to memory of 1888	4052	7e34e19f394f5b2d6c02ac4fcace8f10_NeikiAnalytics.exe	82
PID 4052 wrote to memory of 1888	4052	7e34e19f394f5b2d6c02ac4fcace8f10_NeikiAnalytics.exe	82
PID 1888 wrote to memory of 1904	1888	omsecor.exe	97
PID 1888 wrote to memory of 1904	1888	omsecor.exe	97
PID 1888 wrote to memory of 1904	1888	omsecor.exe	97
PID 1904 wrote to memory of 2252	1904	omsecor.exe	98
PID 1904 wrote to memory of 2252	1904	omsecor.exe	98
PID 1904 wrote to memory of 2252	1904	omsecor.exe	98

C:\Users\Admin\AppData\Local\Temp\7e34e19f394f5b2d6c02ac4fcace8f10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7e34e19f394f5b2d6c02ac4fcace8f10_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 bad0eda862b20c8919b542959b239e3fa06275d83ba2b25babb7be4f8193d33c
MD5 b1c238bdf15f294482abf92e410f4705
SHA1 2c5923c9ac526fdfb4bef54479d0a0b53dd3a1a8
SHA512 794d3448f1d49dcb9fe548eb45011847dc049eb92fa58aa8e9d15a57269cf96a72e99b2f245b59be905a3317bdb545bed9bb7890d2f607ad45765003657cf22f
SSDEEP 768:e6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:l8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 8aa2d536fd79dd42cdc92477cda4236d9f0c0a4d967b94d03fd4dd3c6848a149
MD5 b6b459864e0a447d15f640e42624d852
SHA1 14f872ce9faeae2e0a8c2695c4d86db948b951a4
SHA512 63ef9f868da05387e0c202dd4fb92246366c4335aee314dbbb41926775ff7ea5d14455dc1af854aac4f29ba3042f7e0d4507327f639245fe68b04cf2cca8436a
SSDEEP 768:E6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:T8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 35KB
SHA256 51a3564027b2c16d5c8275f6b33e152265b6a4a626810f68935e50604f99b56f
MD5 0137f7014639ed396225bddb2ed5dd36
SHA1 ead75d900a8fa15ba5d9072ad8e35dbc6f4a2231
SHA512 d13bf2ea34555e6add18eff5db418d1357f039c477c1e92b1694eb435522134089778fbb970886d75d693f4e2ea21da792b31d353fce9531223fdd4cb4ad2674
SSDEEP 768:W6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:t8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1888-19-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1888-7-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1888-10-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1888-13-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1888-14-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1888-6-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1904-20-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1904-26-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2252-28-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2252-29-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2252-32-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4052-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4052-4-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads