neconyd | ab64884a66fab8b915d6d546647c73a3b4e0b695ff30c6b88e5638c1c40eab3f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7b7433d71bf5adb1e30443537491e470_NeikiAnalytics.exe
Size 64KB
Sample240602-2vfrcaaa7w
SHA256 ab64884a66fab8b915d6d546647c73a3b4e0b695ff30c6b88e5638c1c40eab3f
MD5 7b7433d71bf5adb1e30443537491e470
SHA1 e975745dbf82d6a01aec3535d107155e8a59d9d7
SHA512 a9a393fe7126440e308119338e9c6cf805a3ad18fa5f2a81cc6d36682fd8686522fd1a31b5dfeeb22316b34609dcbed279697aeadadc3f032d91584a32806c93
SSDEEP 768:VMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:VbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4796	omsecor.exe
2796	omsecor.exe
1112	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 4796	3936	7b7433d71bf5adb1e30443537491e470_NeikiAnalytics.exe	83
PID 3936 wrote to memory of 4796	3936	7b7433d71bf5adb1e30443537491e470_NeikiAnalytics.exe	83
PID 3936 wrote to memory of 4796	3936	7b7433d71bf5adb1e30443537491e470_NeikiAnalytics.exe	83
PID 4796 wrote to memory of 2796	4796	omsecor.exe	98
PID 4796 wrote to memory of 2796	4796	omsecor.exe	98
PID 4796 wrote to memory of 2796	4796	omsecor.exe	98
PID 2796 wrote to memory of 1112	2796	omsecor.exe	99
PID 2796 wrote to memory of 1112	2796	omsecor.exe	99
PID 2796 wrote to memory of 1112	2796	omsecor.exe	99

C:\Users\Admin\AppData\Local\Temp\7b7433d71bf5adb1e30443537491e470_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7b7433d71bf5adb1e30443537491e470_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 7cf43099ea07b7ed9b8b1db089cfc097993e9b29e29a3cce9eca1e25c5825f6b
MD5 d136ad8500004d6fd4c989edce88e38d
SHA1 1a71710485f386c0cd922743e33b383b8594731a
SHA512 69e0cee8bb11f3b73a6b56f3f6839ac92dcb3f5089bffb8f7c988cfb5b12d7768a75f16dd81dbd77e93156f9e4a342fdaf7925949cb82b90cfbd37e4e3289534
SSDEEP 768:UMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:UbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 bb62b5271c50c017436171880e3040a3029b9f255adaf0ceb585da028b4c9e8c
MD5 2cd0bfa97bbfa905a8dec6908da383cf
SHA1 955d19bf975c4fd867eda14ab01d39f76e4983b5
SHA512 69840ba62869615968454e8396ce604e6220b82ee4140edef54178c1ccd9ead2df0e5be8c8947a0f9fe0ed1d72ef82a65ba63ec0810077ad7e9f3f776de4ed68
SSDEEP 768:wMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:wbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 64KB
SHA256 0be84242fa70e889e4257ce760399faf5c58ac45d3d73c53079e73ef90ea726a
MD5 30c80af9483cf9dabc625990e4810352
SHA1 e981bece665eb7a0084da2b816e1bff810a9c9fa
SHA512 fb07baa91041e4e5d70e6aaf866bca5b918198576f0f45a4e31250149f7cbb7868161b88c22a12bf311828a08adace475a821fa2619ff455edb6f4a14b780cca
SSDEEP 768:sMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:sbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads