neconyd | 491eb18a2584a1688e2a97338fbd17cb00f7bc226ac459936ae5c7a153e86cfe

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:37

Target
78389a3734b1537d54a1b00b79aa7620_NeikiAnalytics.exe
Size 88KB
Sample240602-2jv2wsaf85
SHA256 491eb18a2584a1688e2a97338fbd17cb00f7bc226ac459936ae5c7a153e86cfe
MD5 78389a3734b1537d54a1b00b79aa7620
SHA1 dd0634498b0ae0dd8487f3d8abd288d2edb28cfb
SHA512 b645adede8210f7904d02167db8f162896beddcca2f09efe0587258eebf1c7b94f672d331513522e5a41b9ff883c503663eee9b986978ddab1aee05eeb0c09dd
SSDEEP 1536:/d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:3dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
4412	omsecor.exe
2312	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4412	4876	78389a3734b1537d54a1b00b79aa7620_NeikiAnalytics.exe	83
PID 4876 wrote to memory of 4412	4876	78389a3734b1537d54a1b00b79aa7620_NeikiAnalytics.exe	83
PID 4876 wrote to memory of 4412	4876	78389a3734b1537d54a1b00b79aa7620_NeikiAnalytics.exe	83
PID 4412 wrote to memory of 2312	4412	omsecor.exe	98
PID 4412 wrote to memory of 2312	4412	omsecor.exe	98
PID 4412 wrote to memory of 2312	4412	omsecor.exe	98

C:\Users\Admin\AppData\Local\Temp\78389a3734b1537d54a1b00b79aa7620_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\78389a3734b1537d54a1b00b79aa7620_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:2312

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 4fb69a1030ab1cfff43f346aa8da9cc4a348e70fc28cea9d9eec3d0a83afb22a
MD5 1f1eeb30d81e6bf09e6a5ce25a9e008c
SHA1 86c31fa85b834d378624803a715b2f9413f9521d
SHA512 ee8d3babd145b340a3965694a65420107200ee693c1a788003973b0f8ad59722271a98da04feb94d5a6743ebf41382572af0d1c1e5599250335860ec92dde623
SSDEEP 1536:Od9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:WdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 35231d7dface29928a8e02e8252b490e3f1ee3cd18b88d96c25397ddce9d2281
MD5 e109142b2c2e21403347235e54288224
SHA1 5d62e8f4ecb8d9b6a448836e386c777bc0e71042
SHA512 0203318918133aa64f9a42fdeb788374a79e2a17b2a2eeda3446141dfa8b3753928807ed6ce6780c52d8cfe24c41b41017a0d28307dd506b2a3e19c272d91c87
SSDEEP 1536:Cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:ydseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download