neconyd | 34e5eca202fb1ff2d75c174c801e738fa74f7e5eae8ba5c71568d383e62a095e

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 23:54

Target

19be287e4d2fba32fb8ac6f00b436730_NeikiAnalytics.exe
Size

62KB
MD5

19be287e4d2fba32fb8ac6f00b436730
SHA1

7a8747273ed8e78b1bc529d22bb3092a1f617e11
SHA256

34e5eca202fb1ff2d75c174c801e738fa74f7e5eae8ba5c71568d383e62a095e
SHA512

8337f6c959fce2a86e97219e9bf3639dd73d83973f327be92c10a7cda9fac8f17428c7c78b4cb640f3cce096b7d112efe89366ba22674cdbd78551e44f3e8d83
SSDEEP

768:HMEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:HbIvYvZEyFKF6N4yS+AQmZtl/5

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Executes dropped EXE 3 IoCs

Loads dropped DLL 6 IoCs

pid	Process
2036	19be287e4d2fba32fb8ac6f00b436730_NeikiAnalytics.exe
2036	19be287e4d2fba32fb8ac6f00b436730_NeikiAnalytics.exe
2940	omsecor.exe
2940	omsecor.exe
1968	omsecor.exe
1968	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2940	2036	19be287e4d2fba32fb8ac6f00b436730_NeikiAnalytics.exe	28
PID 2036 wrote to memory of 2940	2036	19be287e4d2fba32fb8ac6f00b436730_NeikiAnalytics.exe	28
PID 2036 wrote to memory of 2940	2036	19be287e4d2fba32fb8ac6f00b436730_NeikiAnalytics.exe	28
PID 2036 wrote to memory of 2940	2036	19be287e4d2fba32fb8ac6f00b436730_NeikiAnalytics.exe	28
PID 2940 wrote to memory of 1968	2940	omsecor.exe	32
PID 2940 wrote to memory of 1968	2940	omsecor.exe	32
PID 2940 wrote to memory of 1968	2940	omsecor.exe	32
PID 2940 wrote to memory of 1968	2940	omsecor.exe	32
PID 1968 wrote to memory of 1904	1968	omsecor.exe	33
PID 1968 wrote to memory of 1904	1968	omsecor.exe	33
PID 1968 wrote to memory of 1904	1968	omsecor.exe	33
PID 1968 wrote to memory of 1904	1968	omsecor.exe	33

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
62KB

MD5
d0cebd688a2a2fb17875e7b9a17c6d80

SHA1
d04721b9c7d3c86fb67a0bb7ce1e6b68898b232b

SHA256
62f0e24e5e3c529caba1635df8561bbec5c7a6cf2455e0cc9aefe2acc0ca4ec9

SHA512
a9a4cdfc70f8cfad3053aa3702d846e2cd2692563c22e202f55a1cbb2f6703c9189a999a43da2a0d88756092cb975c3da1e1e97e3c4839260ac7af096c1d8eef

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
62KB

MD5
762317990f751ee56137f7f901381c26

SHA1
036a56d7312d80a865ae3eab9445f738e0b383fe

SHA256
866ed566a7ee09131c5921521c22677efdcaf9078ef3d3a78fa2b1b8b864edce

SHA512
27283806504031f37bfb8a1a3e8553ff09b0745b0b70d6ed39c7b931e3d40f13033389fa0ef877b4633bc594b1773bfbd5465c95beb712d9b4c258d91c01804f

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
62KB

MD5
ef6bb00684e38dfcc8ea9faec615a85a

SHA1
37db3be228546fa3f726f01faf7237813883ec77

SHA256
940f1e6fc7d67b04ccd9c8bf080175a9a561dda873e9bc2fa33572c7007eb607

SHA512
a4cfcb312b3a20ad8b8132871a787a82d76cc8b57298e45dbf67aeefaa5c59d6a57498c4c3cdbf118a14278ef6c7676e2b7de8191e9e76432fa5bd7ba3207521

Download Submit