neconyd | 81622b78a5018e2c824f28b84b2648d115bdd5a6fed724478cf54faf2df8d1ec

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe
Size 96KB
Sample240603-a7bvdadc2x
SHA256 81622b78a5018e2c824f28b84b2648d115bdd5a6fed724478cf54faf2df8d1ec
MD5 8ffdf3246218dc71d530d4f02771ad90
SHA1 8a2378ee0a5430ffb1bb033e469f8856ea073e89
SHA512 45298e6d0982e45d115e7c27079e893a1dfb1dd0459294a9e92e9b4e6998f29b944d05465c360d51a899edc6ddff2229ed34ea15cbb842fb615eeee619adb126
SSDEEP 1536:WnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:WGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
3744	omsecor.exe
1560	omsecor.exe
4792	omsecor.exe
764	omsecor.exe
3312	omsecor.exe
2484	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2200 set thread context of 1144	2200	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	81
PID 3744 set thread context of 1560	3744	omsecor.exe	85
PID 4792 set thread context of 764	4792	omsecor.exe	101
PID 3312 set thread context of 2484	3312	omsecor.exe	105

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2140	2200	WerFault.exe	80
4784	3744	WerFault.exe	83
4896	4792	WerFault.exe	100
4324	3312	WerFault.exe	103

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1144	2200	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	81
PID 2200 wrote to memory of 1144	2200	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	81
PID 2200 wrote to memory of 1144	2200	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	81
PID 2200 wrote to memory of 1144	2200	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	81
PID 2200 wrote to memory of 1144	2200	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	81
PID 1144 wrote to memory of 3744	1144	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	83
PID 1144 wrote to memory of 3744	1144	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	83
PID 1144 wrote to memory of 3744	1144	8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe	83
PID 3744 wrote to memory of 1560	3744	omsecor.exe	85
PID 3744 wrote to memory of 1560	3744	omsecor.exe	85
PID 3744 wrote to memory of 1560	3744	omsecor.exe	85
PID 3744 wrote to memory of 1560	3744	omsecor.exe	85
PID 3744 wrote to memory of 1560	3744	omsecor.exe	85
PID 1560 wrote to memory of 4792	1560	omsecor.exe	100
PID 1560 wrote to memory of 4792	1560	omsecor.exe	100
PID 1560 wrote to memory of 4792	1560	omsecor.exe	100
PID 4792 wrote to memory of 764	4792	omsecor.exe	101
PID 4792 wrote to memory of 764	4792	omsecor.exe	101
PID 4792 wrote to memory of 764	4792	omsecor.exe	101
PID 4792 wrote to memory of 764	4792	omsecor.exe	101
PID 4792 wrote to memory of 764	4792	omsecor.exe	101
PID 764 wrote to memory of 3312	764	omsecor.exe	103
PID 764 wrote to memory of 3312	764	omsecor.exe	103
PID 764 wrote to memory of 3312	764	omsecor.exe	103
PID 3312 wrote to memory of 2484	3312	omsecor.exe	105
PID 3312 wrote to memory of 2484	3312	omsecor.exe	105
PID 3312 wrote to memory of 2484	3312	omsecor.exe	105
PID 3312 wrote to memory of 2484	3312	omsecor.exe	105
PID 3312 wrote to memory of 2484	3312	omsecor.exe	105

C:\Users\Admin\AppData\Local\Temp\8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\8ffdf3246218dc71d530d4f02771ad90_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1560
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4792
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:764
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:2484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 256
        8⤵
        Program crash
        
        PID:4324
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 292
        6⤵
        Program crash
        
        PID:4896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 300
      4⤵
      Program crash
      PID:4784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 288
  2⤵
  - Program crash
  PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2200 -ip 2200
1⤵
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3744 -ip 3744
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4792 -ip 4792
1⤵
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3312 -ip 3312
1⤵
PID:4532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 d6506971e0d5b85d915e830f300e1e34a3ae6a48062f424a08b2c832ba084fd5
MD5 88c261ec9babfa72ce19ff22e2a06d8f
SHA1 31a7ede5cc27bf10ff36dfd63f95214287d1e3ed
SHA512 36ddd2a0e0d4ee77649d60763bb68217d11cd213255412e3fbe6bd6329e7bc973a78b4941bdfab029260b4c1e96d60092f9a337900c95fd734323b7912e3a4aa
SSDEEP 1536:lnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:lGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 dd51cf6e2342af31769255900406daa800cc0267fc6f3d32279935f0c4d7ea50
MD5 0bbc407dd897922d6438c08df4789159
SHA1 cc315bc8c56044bfd904bc817a88f2bf118391a5
SHA512 ce3ee36f80e00b78d974e716ea1240540e24d5cdec2a3a50447bef0d0ae6dadb25f6ad4cbb2e8b99227966c7dc6449ff5ec68221c048aaf79268cb4d2d628edc
SSDEEP 1536:GnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:GGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 626d6d3c468bace62b32dc271ccad7ad72849c0bc60bdbe9218b27d2797cd352
MD5 d113de9d6516c8e703ad6aacb541d8c5
SHA1 5908d5cdd48c33ee45c2881ebe082287b03919bc
SHA512 f05e4e6360b8bf9c786c905311063221b06a50d10fdc7ae135675857baeb375e2ad63bd561981ccd5096086783d90fe0307245c659ebcb29cdf3d6f266ba1446
SSDEEP 1536:gnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:gGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/764-38-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/764-40-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/764-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1144-12-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1144-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1144-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1144-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1560-17-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1560-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1560-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1560-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1560-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1560-27-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1560-31-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2200-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2484-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2484-50-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2484-54-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2484-57-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3312-45-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3744-10-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3744-18-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4792-33-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4792-52-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads