neconyd | 7775c62a178b84ea1a7738976faa8f4071c75703f03a4ca77d7ff9fcec35ec53

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
24805876894a9a5c9781ce47be5ea890_NeikiAnalytics.exe
Size 96KB
Sample240602-cr16faga83
SHA256 7775c62a178b84ea1a7738976faa8f4071c75703f03a4ca77d7ff9fcec35ec53
MD5 24805876894a9a5c9781ce47be5ea890
SHA1 3e1d73a53bf17f9186f8c48a7f6fe9e9df013933
SHA512 ad89f291a3f92831854204df84cdeb595005ab4d64b986d7196a0a58fc46809da31bf621ee7412afc93d3077a005b753f0432587cb13913e073a30490f342c89
SSDEEP 1536:qnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:qGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
1820	omsecor.exe
1636	omsecor.exe
1428	omsecor.exe
4652	omsecor.exe
704	omsecor.exe
4848	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2892 set thread context of 2372	2892	24805876894a9a5c9781ce47be5ea890_NeikiAnalytics.exe	91
PID 1820 set thread context of 1636	1820	omsecor.exe	95
PID 1428 set thread context of 4652	1428	omsecor.exe	117
PID 704 set thread context of 4848	704	omsecor.exe	121

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3724	2892	WerFault.exe	90
4956	1820	WerFault.exe	93
2036	1428	WerFault.exe	116
1652	704	WerFault.exe	119

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2372	2892	24805876894a9a5c9781ce47be5ea890_NeikiAnalytics.exe	91
PID 2892 wrote to memory of 2372	2892	24805876894a9a5c9781ce47be5ea890_NeikiAnalytics.exe	91
PID 2892 wrote to memory of 2372	2892	24805876894a9a5c9781ce47be5ea890_NeikiAnalytics.exe	91
PID 2892 wrote to memory of 2372	2892	24805876894a9a5c9781ce47be5ea890_NeikiAnalytics.exe	91
PID 2892 wrote to memory of 2372	2892	24805876894a9a5c9781ce47be5ea890_NeikiAnalytics.exe	91
PID 2372 wrote to memory of 1820	2372	24805876894a9a5c9781ce47be5ea890_NeikiAnalytics.exe	93
PID 2372 wrote to memory of 1820	2372	24805876894a9a5c9781ce47be5ea890_NeikiAnalytics.exe	93
PID 2372 wrote to memory of 1820	2372	24805876894a9a5c9781ce47be5ea890_NeikiAnalytics.exe	93
PID 1820 wrote to memory of 1636	1820	omsecor.exe	95
PID 1820 wrote to memory of 1636	1820	omsecor.exe	95
PID 1820 wrote to memory of 1636	1820	omsecor.exe	95
PID 1820 wrote to memory of 1636	1820	omsecor.exe	95
PID 1820 wrote to memory of 1636	1820	omsecor.exe	95
PID 1636 wrote to memory of 1428	1636	omsecor.exe	116
PID 1636 wrote to memory of 1428	1636	omsecor.exe	116
PID 1636 wrote to memory of 1428	1636	omsecor.exe	116
PID 1428 wrote to memory of 4652	1428	omsecor.exe	117
PID 1428 wrote to memory of 4652	1428	omsecor.exe	117
PID 1428 wrote to memory of 4652	1428	omsecor.exe	117
PID 1428 wrote to memory of 4652	1428	omsecor.exe	117
PID 1428 wrote to memory of 4652	1428	omsecor.exe	117
PID 4652 wrote to memory of 704	4652	omsecor.exe	119
PID 4652 wrote to memory of 704	4652	omsecor.exe	119
PID 4652 wrote to memory of 704	4652	omsecor.exe	119
PID 704 wrote to memory of 4848	704	omsecor.exe	121
PID 704 wrote to memory of 4848	704	omsecor.exe	121
PID 704 wrote to memory of 4848	704	omsecor.exe	121
PID 704 wrote to memory of 4848	704	omsecor.exe	121
PID 704 wrote to memory of 4848	704	omsecor.exe	121

C:\Users\Admin\AppData\Local\Temp\24805876894a9a5c9781ce47be5ea890_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\24805876894a9a5c9781ce47be5ea890_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Local\Temp\24805876894a9a5c9781ce47be5ea890_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\24805876894a9a5c9781ce47be5ea890_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1428
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:704
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:4848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 704 -s 256
        8⤵
        Program crash
        
        PID:1652
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 292
        6⤵
        Program crash
        
        PID:2036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 288
      4⤵
      Program crash
      PID:4956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 288
  2⤵
  - Program crash
  PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2892 -ip 2892
1⤵
PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1820 -ip 1820
1⤵
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4076,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:8
1⤵
PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1428 -ip 1428
1⤵
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 704 -ip 704
1⤵
PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 771c2a2760f24fb8d67660ebad2a8f869e562ebff3dec99ce5b961689e2ebedf
MD5 64376a0b794b43cd4b7c1fb996523a12
SHA1 6c4619c5d8629405f5e19b16d0f6631a889f42c2
SHA512 1f727516d688c320ca9c1056f6188e0b240bec75e93b78529518d31c0bd7eccbd333cb3a4f62005958477c2124cf461a0f1bacd7a005c0001871c744b24d8657
SSDEEP 1536:bnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:bGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 947f0903dd0bf4401ee0698a69d1c824b06f594c3bf9bb77d8bccb579017970c
MD5 3564e7cb3ab0a62fc37da86c1597676f
SHA1 037724a9f00dfc6639485223b9f041a85caf9ef7
SHA512 e5e7be703142167dcec953c5e48a57e0882d5e0b2c9397141ba74e42c054aaba1bf52df29b2dba459976ac552a6efd842ee9c0b8ad7f16d6e13699103ea238e1
SSDEEP 1536:jnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:jGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 9ed664343a86a2623248da7a03b63f5096184dddaf7369aa3ad3edfe1e5fabd2
MD5 3f9c6cd46b54bbfc6f361bb981194d79
SHA1 f6b72482fc8d0adc13592372470db342e26673cc
SHA512 7bd897f29ba763d56d84c10b1cb71b3bdf14af441b8dec67e52e5020cea55176382b72a8bd952ade4118f85cbbe3ed4bad6eed33949bc78e9ded836afecd28bf
SSDEEP 1536:jnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:jGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/704-45-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1428-34-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1428-52-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1636-33-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1636-13-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1636-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1636-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1636-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1636-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1636-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1820-10-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1820-18-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2372-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2372-6-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2372-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2372-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2892-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4652-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4652-42-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4652-38-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4848-50-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4848-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4848-54-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4848-57-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads