neconyd | 8fd6839e9632927049b865f0e4f0b3159f979cc94ea109df05fae519ee59ff6c

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0ae3074116b5a83b2786393d560e8fa0_NeikiAnalytics.exe
Size 35KB
Sample240604-1yah3ada2z
SHA256 8fd6839e9632927049b865f0e4f0b3159f979cc94ea109df05fae519ee59ff6c
MD5 0ae3074116b5a83b2786393d560e8fa0
SHA1 400c00306b0efcb93b9daddcd902ff75a15153c6
SHA512 ce7ef82006260493f8294901bdfad0c85fc1f91f8ef815d1c0aec6b1c3a6426d6e75bd618cfa5418c245094cc2b1c5fdcc5a424cc700540d77be26d641e71474
SSDEEP 768:H6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:a8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
3540	omsecor.exe
2068	omsecor.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5024-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/5024-5-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x00090000000235d2-4.dat	upx
behavioral2/memory/3540-6-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/3540-8-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/3540-11-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/3540-14-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/3540-15-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/3540-20-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x000d0000000235e7-18.dat	upx
behavioral2/memory/2068-21-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2068-23-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2068-26-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 3540	5024	0ae3074116b5a83b2786393d560e8fa0_NeikiAnalytics.exe	90
PID 5024 wrote to memory of 3540	5024	0ae3074116b5a83b2786393d560e8fa0_NeikiAnalytics.exe	90
PID 5024 wrote to memory of 3540	5024	0ae3074116b5a83b2786393d560e8fa0_NeikiAnalytics.exe	90
PID 3540 wrote to memory of 2068	3540	omsecor.exe	106
PID 3540 wrote to memory of 2068	3540	omsecor.exe	106
PID 3540 wrote to memory of 2068	3540	omsecor.exe	106

C:\Users\Admin\AppData\Local\Temp\0ae3074116b5a83b2786393d560e8fa0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0ae3074116b5a83b2786393d560e8fa0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,16488180140590516186,11762960689811837350,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:8
1⤵
PID:4456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 9cdc9b1f55244c4f4bcd42b377d5191081a100d42ac2e8fcd039879d40e9a71a
MD5 73fd4bc7cec39c30b2b22a293c62d6fb
SHA1 17b989d90fc7c4dda3adae60a5a251a1900567ee
SHA512 12855fa94ac6e93bdc74feb21817ceae445eb920df8a6e7f993fe5d05eee9021305bdaadb6089208e426c95404728f1dc536a938f0dd0cd55ea43e7993c0cb50
SSDEEP 768:A6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:X8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 35KB
SHA256 cac0da4ea504c60c1bdddf7c0405420b5fb579ad43818fec941d6fc55d570527
MD5 bc945207d312a45440476f2dcf87da80
SHA1 67602bf49e862f5ede3d674e6e3d7973b526cc2f
SHA512 638e2182d23f66c5e34a25de19f4b0886c4d143d64dc8c0de1796595fc54570400ebd2f1f1d9000b8ee3bb335a1dc82d120040ec244e200cfb801c92f5903e7d
SSDEEP 768:t6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:g8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2068-26-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2068-23-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2068-21-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3540-6-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3540-14-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3540-15-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3540-20-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3540-11-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3540-8-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/5024-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/5024-5-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads