neconyd | 15e088cb0fd43cb11f49261577f7060ac8d02bc8128ba911e0b50f72f51608e2

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 05:43

Target
9d81ba2d14329020eca8eae07bc608b0_NeikiAnalytics.exe
Size 80KB
Sample240603-ge2cwsde7w
SHA256 15e088cb0fd43cb11f49261577f7060ac8d02bc8128ba911e0b50f72f51608e2
MD5 9d81ba2d14329020eca8eae07bc608b0
SHA1 05db0126e730e5ae50ee59e7b9af09116e8dd9fd
SHA512 335e4c7aa0396fb33304eb2172d4dfa96ceb1469d2883745e97e66ebf5add08f87abcd4a0ed6898c40b51e5b49a2fb1ef976c2e962626f60d969cc453ac86c24
SSDEEP 768:AfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:AfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
444	omsecor.exe
4416	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 444	5056	9d81ba2d14329020eca8eae07bc608b0_NeikiAnalytics.exe	82
PID 5056 wrote to memory of 444	5056	9d81ba2d14329020eca8eae07bc608b0_NeikiAnalytics.exe	82
PID 5056 wrote to memory of 444	5056	9d81ba2d14329020eca8eae07bc608b0_NeikiAnalytics.exe	82
PID 444 wrote to memory of 4416	444	omsecor.exe	99
PID 444 wrote to memory of 4416	444	omsecor.exe	99
PID 444 wrote to memory of 4416	444	omsecor.exe	99

C:\Users\Admin\AppData\Local\Temp\9d81ba2d14329020eca8eae07bc608b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9d81ba2d14329020eca8eae07bc608b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:444
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4416

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 80KB
SHA256 05fd5c4717964bb7ec067e248c9d473bb9dd3f88ad0a804c5ad5256e1a3b78f1
MD5 dcd9832d2313787085a3d99ac9e29072
SHA1 0954d0f40e4245220c02555ec16f2c07d0653c48
SHA512 347cdede64e816643db0ac7323758cb84e397cb233a79a445cf073e5279ae8af18a731374eae6538b96b1848bb375e90fa6787b25ca189ae36eb177bc37ced2e
SSDEEP 768:ofMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:ofbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 80KB
SHA256 d2dddd19b1f50cdd306ca8790a4b032d2299c4a5e21021fd279005c48308ce16
MD5 ea884d73b84f898c8ea27ee6709d8bc8
SHA1 131baad7d82a6a4697680caaea166f34a5b0af95
SHA512 9b13ba20a9a2a2b8bd010d70fa555b0190e32bef26d947a9ea1519d040c5707ea3f70e2c0e82d290bfe38077bc38af1df7551fc8437aa54fa006ab235338d590
SSDEEP 768:lfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:lfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download