neconyd | 8efc5525aae2797bed184e32219100efa6363f2df5c31da2ab138baf58ae5b12

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 00:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8870145b74e448322d3c23164a9ee1c0_NeikiAnalytics.exe
Size 96KB
Sample240603-adzz4sdc63
SHA256 8efc5525aae2797bed184e32219100efa6363f2df5c31da2ab138baf58ae5b12
MD5 8870145b74e448322d3c23164a9ee1c0
SHA1 1acf701aa53939e1f3cc8edb51c94cf85e67ee2f
SHA512 cb987a5d089af0cf18eb0a723e5a2d7f7f46ff18a9b38bd33310564bdc103dca84c29ae443702eca54caf7e60667ffdd6ebc4e995a98ae3f0006e7b7a2144597
SSDEEP 1536:BnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:BGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
5068	omsecor.exe
1456	omsecor.exe
208	omsecor.exe
1164	omsecor.exe
3888	omsecor.exe
2332	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2120 set thread context of 1268	2120	8870145b74e448322d3c23164a9ee1c0_NeikiAnalytics.exe	85
PID 5068 set thread context of 1456	5068	omsecor.exe	89
PID 208 set thread context of 1164	208	omsecor.exe	108
PID 3888 set thread context of 2332	3888	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4948	5068	WerFault.exe	87
2264	2120	WerFault.exe	84
3012	208	WerFault.exe	107
4532	3888	WerFault.exe	110

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 1268	2120	8870145b74e448322d3c23164a9ee1c0_NeikiAnalytics.exe	85
PID 2120 wrote to memory of 1268	2120	8870145b74e448322d3c23164a9ee1c0_NeikiAnalytics.exe	85
PID 2120 wrote to memory of 1268	2120	8870145b74e448322d3c23164a9ee1c0_NeikiAnalytics.exe	85
PID 2120 wrote to memory of 1268	2120	8870145b74e448322d3c23164a9ee1c0_NeikiAnalytics.exe	85
PID 2120 wrote to memory of 1268	2120	8870145b74e448322d3c23164a9ee1c0_NeikiAnalytics.exe	85
PID 1268 wrote to memory of 5068	1268	8870145b74e448322d3c23164a9ee1c0_NeikiAnalytics.exe	87
PID 1268 wrote to memory of 5068	1268	8870145b74e448322d3c23164a9ee1c0_NeikiAnalytics.exe	87
PID 1268 wrote to memory of 5068	1268	8870145b74e448322d3c23164a9ee1c0_NeikiAnalytics.exe	87
PID 5068 wrote to memory of 1456	5068	omsecor.exe	89
PID 5068 wrote to memory of 1456	5068	omsecor.exe	89
PID 5068 wrote to memory of 1456	5068	omsecor.exe	89
PID 5068 wrote to memory of 1456	5068	omsecor.exe	89
PID 5068 wrote to memory of 1456	5068	omsecor.exe	89
PID 1456 wrote to memory of 208	1456	omsecor.exe	107
PID 1456 wrote to memory of 208	1456	omsecor.exe	107
PID 1456 wrote to memory of 208	1456	omsecor.exe	107
PID 208 wrote to memory of 1164	208	omsecor.exe	108
PID 208 wrote to memory of 1164	208	omsecor.exe	108
PID 208 wrote to memory of 1164	208	omsecor.exe	108
PID 208 wrote to memory of 1164	208	omsecor.exe	108
PID 208 wrote to memory of 1164	208	omsecor.exe	108
PID 1164 wrote to memory of 3888	1164	omsecor.exe	110
PID 1164 wrote to memory of 3888	1164	omsecor.exe	110
PID 1164 wrote to memory of 3888	1164	omsecor.exe	110
PID 3888 wrote to memory of 2332	3888	omsecor.exe	112
PID 3888 wrote to memory of 2332	3888	omsecor.exe	112
PID 3888 wrote to memory of 2332	3888	omsecor.exe	112
PID 3888 wrote to memory of 2332	3888	omsecor.exe	112
PID 3888 wrote to memory of 2332	3888	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\8870145b74e448322d3c23164a9ee1c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8870145b74e448322d3c23164a9ee1c0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\8870145b74e448322d3c23164a9ee1c0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\8870145b74e448322d3c23164a9ee1c0_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1456
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:208
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1164
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3888
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:2332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 244
        8⤵
        Program crash
        
        PID:4532
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 292
        6⤵
        Program crash
        
        PID:3012
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 304
      4⤵
      Program crash
      PID:4948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 288
  2⤵
  - Program crash
  PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2120 -ip 2120
1⤵
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5068 -ip 5068
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 208 -ip 208
1⤵
PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3888 -ip 3888
1⤵
PID:824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 30b1178bbf1c7694553cb10956f0091aa5eca100210d63e5b2d67a510c880db4
MD5 8f3ff98b7b8d7f924e67f03f3b777042
SHA1 4da26c49519f9c4fd52e15f082fe3d6e15d711ff
SHA512 5ea08419af3bb4dbfd046f094282f544cc8b310af2def5c081aeafc3ab2fa94e1ec9804611f56a197365cad6392b60f4b679609b9dfd3e60a5585dbf5fea8758
SSDEEP 1536:CnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:CGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 7c84aefcdec956e32126a826e93ba640d0810da9baeead78e2477707e42e546f
MD5 20035a38dba74215aa4bd8a420e03628
SHA1 123c50f09a99f2d8d17adda1dfa6fd46c1cc2701
SHA512 8edaa5d4873616cfd52bb54999357b43c408172757984d9b765c16d7b2ef91452ced57aa77c98e995e0525de4bb131555a118b415ac02a3bed7b8d980174f33f
SSDEEP 1536:pnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:pGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 0174f86e41100a0c786ff19a6b30df33ce375dc71c5025c7cca5f62579ea9074
MD5 e8ee2f15f3240e51d9a31cd0515c7dec
SHA1 68a3316ba86bb02caabfc0fb45f3dd8a9e1104ae
SHA512 a3dde47f552b7871a02afac16e4acc1f58dd59f4e572cb5ec3ed5d4c0d7650795456f47ee88987c6091debe04819c65580ec9f073ae240f7d5b34242c7cd277a
SSDEEP 1536:TnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:TGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-52-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/208-34-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1164-38-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1164-40-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1164-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1268-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1268-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1268-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1268-7-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1456-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1456-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1456-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1456-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1456-33-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1456-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1456-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2120-18-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2120-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2332-50-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2332-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2332-53-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2332-56-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3888-45-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5068-11-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads