neconyd | f9c7c55a14ac383cb2ff17bfe47887db75de7b8efb633a412c6683fbb3997dae

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 20:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6167b3ac14bda864420aa4bc107876e0_NeikiAnalytics.exe
Size 88KB
Sample240602-zcm2laeb3s
SHA256 f9c7c55a14ac383cb2ff17bfe47887db75de7b8efb633a412c6683fbb3997dae
MD5 6167b3ac14bda864420aa4bc107876e0
SHA1 a407e783bb1f2c7671444129aa7708c4c04fa287
SHA512 b4f2715ba0d3807d21c3bd7dbc7996a5332db4a721217a7d6c6b3f30712a048130588cb7886ed2033a3b43a78ce97dc9cf2e24a7dc3f8d5e20cd5c11d14e9d35
SSDEEP 1536:td9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:FdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4700	omsecor.exe
1632	omsecor.exe
916	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 4700	3620	6167b3ac14bda864420aa4bc107876e0_NeikiAnalytics.exe	84
PID 3620 wrote to memory of 4700	3620	6167b3ac14bda864420aa4bc107876e0_NeikiAnalytics.exe	84
PID 3620 wrote to memory of 4700	3620	6167b3ac14bda864420aa4bc107876e0_NeikiAnalytics.exe	84
PID 4700 wrote to memory of 1632	4700	omsecor.exe	96
PID 4700 wrote to memory of 1632	4700	omsecor.exe	96
PID 4700 wrote to memory of 1632	4700	omsecor.exe	96
PID 1632 wrote to memory of 916	1632	omsecor.exe	97
PID 1632 wrote to memory of 916	1632	omsecor.exe	97
PID 1632 wrote to memory of 916	1632	omsecor.exe	97

C:\Users\Admin\AppData\Local\Temp\6167b3ac14bda864420aa4bc107876e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6167b3ac14bda864420aa4bc107876e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 7ddef70d95e2050080df508a5f859250560b98a27c41889cbf5291e07e19f701
MD5 abcff45e2b497de327ac391883a57781
SHA1 0cd059a36b3b4f9c3b2183f2cb0503705b26876e
SHA512 7a1b0959ab4e45a36659a2de4e96f9e558977388228f492f24607b48b4d1381d36a289c6c0a1bb971119421c9d15f419d53875d1fa370a552d5e50bc78bc598d
SSDEEP 1536:Wd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:udseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 faed886a227b37b6f9791412e275b57dfb58a47918a8288a8e48941b9e13068c
MD5 ba5be881e0ed9febce25c9781acd5af8
SHA1 dbbd54870801ae3d1346d5b76eb8e8c3462b115d
SHA512 09ab68f0f9b693f5ce0bd1cc025bacd19db7ba751776d7a7584319d35616cbe3f67eb27ecea3e64f00530f7bbb4814c13093d63ac30099a7b1a822d5c69eb44a
SSDEEP 1536:gd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:AdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 2e0491eb00713255ac9645f8ef66e3270f62383acffc33bc5c88419c51de084a
MD5 f4c9cc0be505684860c3fe555b63e5f3
SHA1 76fae6026035853941fda82453c040668d7c9148
SHA512 07e6506397806d3e2404a19c4e4604cb9c5c7a835fd6692f67712b1cd0af529d09ca46a871b5cfca28cace371c48b62875e2e1ed8ac6b86d21e40bd0ff2c8148
SSDEEP 1536:9d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:1dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads