neconyd | 81622b78a5018e2c824f28b84b2648d115bdd5a6fed724478cf54faf2df8d1ec

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe
Size 96KB
Sample240603-a7bvdadc2x
SHA256 81622b78a5018e2c824f28b84b2648d115bdd5a6fed724478cf54faf2df8d1ec
MD5 8ffdf3246218dc71d530d4f02771ad90
SHA1 8a2378ee0a5430ffb1bb033e469f8856ea073e89
SHA512 45298e6d0982e45d115e7c27079e893a1dfb1dd0459294a9e92e9b4e6998f29b944d05465c360d51a899edc6ddff2229ed34ea15cbb842fb615eeee619adb126
SSDEEP 1536:WnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:WGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
3004	omsecor.exe
3044	omsecor.exe
2620	omsecor.exe
2788	omsecor.exe
1652	omsecor.exe
2680	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
1188	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe
1188	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe
3004	omsecor.exe
3044	omsecor.exe
3044	omsecor.exe
2788	omsecor.exe
2788	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1712 set thread context of 1188	1712	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	28
PID 3004 set thread context of 3044	3004	omsecor.exe	30
PID 2620 set thread context of 2788	2620	omsecor.exe	35
PID 1652 set thread context of 2680	1652	omsecor.exe	37

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1188	1712	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	28
PID 1712 wrote to memory of 1188	1712	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	28
PID 1712 wrote to memory of 1188	1712	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	28
PID 1712 wrote to memory of 1188	1712	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	28
PID 1712 wrote to memory of 1188	1712	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	28
PID 1712 wrote to memory of 1188	1712	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	28
PID 1188 wrote to memory of 3004	1188	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	29
PID 1188 wrote to memory of 3004	1188	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	29
PID 1188 wrote to memory of 3004	1188	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	29
PID 1188 wrote to memory of 3004	1188	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	29
PID 3004 wrote to memory of 3044	3004	omsecor.exe	30
PID 3004 wrote to memory of 3044	3004	omsecor.exe	30
PID 3004 wrote to memory of 3044	3004	omsecor.exe	30
PID 3004 wrote to memory of 3044	3004	omsecor.exe	30
PID 3004 wrote to memory of 3044	3004	omsecor.exe	30
PID 3004 wrote to memory of 3044	3004	omsecor.exe	30
PID 3044 wrote to memory of 2620	3044	omsecor.exe	34
PID 3044 wrote to memory of 2620	3044	omsecor.exe	34
PID 3044 wrote to memory of 2620	3044	omsecor.exe	34
PID 3044 wrote to memory of 2620	3044	omsecor.exe	34
PID 2620 wrote to memory of 2788	2620	omsecor.exe	35
PID 2620 wrote to memory of 2788	2620	omsecor.exe	35
PID 2620 wrote to memory of 2788	2620	omsecor.exe	35
PID 2620 wrote to memory of 2788	2620	omsecor.exe	35
PID 2620 wrote to memory of 2788	2620	omsecor.exe	35
PID 2620 wrote to memory of 2788	2620	omsecor.exe	35
PID 2788 wrote to memory of 1652	2788	omsecor.exe	36
PID 2788 wrote to memory of 1652	2788	omsecor.exe	36
PID 2788 wrote to memory of 1652	2788	omsecor.exe	36
PID 2788 wrote to memory of 1652	2788	omsecor.exe	36
PID 1652 wrote to memory of 2680	1652	omsecor.exe	37
PID 1652 wrote to memory of 2680	1652	omsecor.exe	37
PID 1652 wrote to memory of 2680	1652	omsecor.exe	37
PID 1652 wrote to memory of 2680	1652	omsecor.exe	37
PID 1652 wrote to memory of 2680	1652	omsecor.exe	37
PID 1652 wrote to memory of 2680	1652	omsecor.exe	37

C:\Users\Admin\AppData\Local\Temp\8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3044
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2620
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 dd51cf6e2342af31769255900406daa800cc0267fc6f3d32279935f0c4d7ea50
MD5 0bbc407dd897922d6438c08df4789159
SHA1 cc315bc8c56044bfd904bc817a88f2bf118391a5
SHA512 ce3ee36f80e00b78d974e716ea1240540e24d5cdec2a3a50447bef0d0ae6dadb25f6ad4cbb2e8b99227966c7dc6449ff5ec68221c048aaf79268cb4d2d628edc
SSDEEP 1536:GnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:GGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 48f92dd91c6c4f7a87f230641a6e44adc711d2f30622bd3e8cf851791dad6edc
MD5 43d0c0b98a2e49afc850c5b26ab7d979
SHA1 2fce3d70a6af84814e61abff6123bf030fae15bd
SHA512 d10ce41870eaa7c8f86e3953b27f6f1fb0dae2a8829479f437d405bd5fbafc53b0a2d6d9f1e37457c498b5f7b10ee2201ae595a70f22f252ff18e5100b117e6a
SSDEEP 1536:3nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:3Gs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 bc4e70e5aa2657eacc9647330d248e222e6f95952bb8049f27581684f8bbf641
MD5 ad1688dfd45900775b61586b696a76a2
SHA1 172e6563b37515ec4352bef6c4245fc182eea448
SHA512 4c38b24d7af238df8345289cd954666fb7a486a64d1d642fadf00215c5c9e947733ecae40d8350cb1b865deb1ffb8e62e3aa92e063be259c3d8bdefbf7d966c6
SSDEEP 1536:TnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:TGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1188-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1188-6-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1188-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1188-12-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1188-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1652-86-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1652-78-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1712-8-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1712-1-0x00000000003D0000-0x00000000003F3000-memory.dmp

Download

memory/1712-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2620-65-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2680-88-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2680-91-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3004-32-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3004-22-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3044-44-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3044-41-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3044-47-0x00000000005C0000-0x00000000005E3000-memory.dmp

Download

memory/3044-55-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3044-38-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3044-35-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads