neconyd | 642d7824616e4bcff326d0031f305d469214b378365862eeb22667cbc02d010b

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
24d3c8e9b9dbc41b8db52f6022ebad60_NeikiAnalytics.exe
Size 64KB
Sample240602-ctnywsgb46
SHA256 642d7824616e4bcff326d0031f305d469214b378365862eeb22667cbc02d010b
MD5 24d3c8e9b9dbc41b8db52f6022ebad60
SHA1 f8ff70ca74e0f0ae8b2f42e55d99a19d586c0c4c
SHA512 d4719df5d59b5567e657dc28664152c0ec54a4ebae3a81aae0fb1b9e975ae58b4b466ee43bcff17c03d215657f5d53d86249b38d00a3fc7670832afb8aa912f3
SSDEEP 768:VMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:VbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4160	omsecor.exe
2732	omsecor.exe
3692	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 4160	3724	24d3c8e9b9dbc41b8db52f6022ebad60_NeikiAnalytics.exe	83
PID 3724 wrote to memory of 4160	3724	24d3c8e9b9dbc41b8db52f6022ebad60_NeikiAnalytics.exe	83
PID 3724 wrote to memory of 4160	3724	24d3c8e9b9dbc41b8db52f6022ebad60_NeikiAnalytics.exe	83
PID 4160 wrote to memory of 2732	4160	omsecor.exe	100
PID 4160 wrote to memory of 2732	4160	omsecor.exe	100
PID 4160 wrote to memory of 2732	4160	omsecor.exe	100
PID 2732 wrote to memory of 3692	2732	omsecor.exe	101
PID 2732 wrote to memory of 3692	2732	omsecor.exe	101
PID 2732 wrote to memory of 3692	2732	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\24d3c8e9b9dbc41b8db52f6022ebad60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\24d3c8e9b9dbc41b8db52f6022ebad60_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 f455427bf93e6d6056307dcfee1cdb1362125c49b569a492f199003d4487e15c
MD5 2aaca8e0ab36bd42a3979e7d4e22f859
SHA1 6268715443ad4767807f85c84e45cc9277399569
SHA512 e2d242815c0945edc8c1769d8a6936196133d660049b5e072a2f4194ff9ffe45d1989c13cf58e87fba2f4ec1c3c66f033a0ebec80b582776862599f9ff37c798
SSDEEP 768:mMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:mbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 0c153adc0384dbff4dd9025150f187a8679e4eefdfc788c800df45a51e267d29
MD5 6e2df2e4a52324cdd35308e7c952482e
SHA1 003dc50ddcb1242fe8ae2e21658dfa2e1d890f0f
SHA512 607950f399f2d3a3f6b1e9ac7b5970ca78406926d82a6b4ae2b87cb2baf9977963b444b1f52491ea15bec71126fd97e3a82933ee027d55b5756cb2d4f1b91d1a
SSDEEP 768:hMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:hbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 64KB
SHA256 184708f1330f6a1c0130d6e40b6c987fadb754bab9649b3c36f64fedcbd226fe
MD5 bdcf794ce9c6301ec72dafa24d2fa4f8
SHA1 a9ce818fbf61ff9f3a440ac060495fde424d94e1
SHA512 f1b0949fbf4d8b1325d3e5a4e4d533a5a19e66a2172db3fcc2d68f2ed4a2626e8c5d2f9d8a4599a1a89a718a60be3c9a0ab155655efc7062be3ccc408a339f94
SSDEEP 768:CMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:CbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads