neconyd | fc05e8ce74e888ccb14e2c15f6fd42b7f36c8094e5cb0614dfecfd785e4801bc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 23:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
196f146d652d53b42c42b78a764617a0_NeikiAnalytics.exe
Size 92KB
Sample240604-3wk8wsgd78
SHA256 fc05e8ce74e888ccb14e2c15f6fd42b7f36c8094e5cb0614dfecfd785e4801bc
MD5 196f146d652d53b42c42b78a764617a0
SHA1 1ecca4d02804014b77a88ed32be97e5706b6424d
SHA512 c3dd0dfbe88ec1e4d95e76c1712ba81822c8185551b370ef7fbb7e141f908385911e4e0f071e21578d40dcd0b88892374f051e3a69dd40f71fba390d705e4d28
SSDEEP 768:tMTIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:tUIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
2636	omsecor.exe
4356	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 2636	3352	196f146d652d53b42c42b78a764617a0_NeikiAnalytics.exe	83
PID 3352 wrote to memory of 2636	3352	196f146d652d53b42c42b78a764617a0_NeikiAnalytics.exe	83
PID 3352 wrote to memory of 2636	3352	196f146d652d53b42c42b78a764617a0_NeikiAnalytics.exe	83
PID 2636 wrote to memory of 4356	2636	omsecor.exe	98
PID 2636 wrote to memory of 4356	2636	omsecor.exe	98
PID 2636 wrote to memory of 4356	2636	omsecor.exe	98

C:\Users\Admin\AppData\Local\Temp\196f146d652d53b42c42b78a764617a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\196f146d652d53b42c42b78a764617a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 d6d6f91211ee085b70795c3c3b529a8dc093dc139ebf94899a969ca93cf6d12c
MD5 6b02b75cd72469207a506447367350cf
SHA1 fabdfdcde5fdfc43f34c888d889efbdfc9fb0b99
SHA512 e7791c14d651facd5009fca1873b1e9dd117531223e52b443cdba07174e81ba4ba2d1e672b6c96949af9bf009509b98d0c933ce884c394ee9b2865125aa43fb1
SSDEEP 768:xMTIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:xUIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 92KB
SHA256 109a8ba1693ebb901a58fad77bb6241739561ea06cac678d45f77169ea70e46c
MD5 8a79fd36eda203dd0f56999d79d61d86
SHA1 9f9a7b0ac9d388363464bc942d2ddb3a8773c6c6
SHA512 be00cfc551a6ea55042a6b05f325cbe8f4b050957d58e5ed398386adfe223f97bf6216d1495ee1fcabc0112a7b197838c57692f6bda2743688bc293d0800b239
SSDEEP 768:iMTIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:iUIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2636-5-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2636-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2636-11-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3352-1-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4356-12-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4356-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads