neconyd | 7568faf752d63a56e60b94ed97b553ca1a5a1020fe7cee84861ca60a23826d54

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
211f809d3623ed34339c2851941158e0_NeikiAnalytics.exe
Size 72KB
Sample240604-cqc28aaa3v
SHA256 7568faf752d63a56e60b94ed97b553ca1a5a1020fe7cee84861ca60a23826d54
MD5 211f809d3623ed34339c2851941158e0
SHA1 34536b4cf7afd755ac11bb102dc57045937251cd
SHA512 7b67eb59a1154b063ead71dca10b15f7e0ceb457350e7fb94be4907a4851c9398ccb63078fd69a46a208ec445fd76598c34375eee2e37ec4094e9c78b3a2540a
SSDEEP 768:kMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:kbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4128	omsecor.exe
1236	omsecor.exe
224	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 4128	1312	211f809d3623ed34339c2851941158e0_NeikiAnalytics.exe	90
PID 1312 wrote to memory of 4128	1312	211f809d3623ed34339c2851941158e0_NeikiAnalytics.exe	90
PID 1312 wrote to memory of 4128	1312	211f809d3623ed34339c2851941158e0_NeikiAnalytics.exe	90
PID 4128 wrote to memory of 1236	4128	omsecor.exe	100
PID 4128 wrote to memory of 1236	4128	omsecor.exe	100
PID 4128 wrote to memory of 1236	4128	omsecor.exe	100
PID 1236 wrote to memory of 224	1236	omsecor.exe	101
PID 1236 wrote to memory of 224	1236	omsecor.exe	101
PID 1236 wrote to memory of 224	1236	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\211f809d3623ed34339c2851941158e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\211f809d3623ed34339c2851941158e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3760 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:4516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 3b06347e7a115e78c34bcd4b529a4667218bb8c1924af95b589edae8dada4ff8
MD5 911413ab9ff5e85ed6b4ca212fa461bd
SHA1 2365a1cf4493922731dfbb0ee1b5ad1e6f0321b8
SHA512 5952c6fa364dae66c026806bada9b6c0e010dd64d00dec8be9501a817f67055a2d9535c02252b9dce82512cc545b165da756a387c48313a20d377b4cec6efec6
SSDEEP 768:oMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:obIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 0a68bb239e22acf73bf87b0b0fc3e4789c40955faba22a548a223bc817382a31
MD5 9ab241bb967c83b2d47d414227eb132c
SHA1 9357f61e1aa5a3c1e853e9ad79941695bdd914b1
SHA512 bd306126d21e19fd2fa96e218a47b9c88e9f3d04260c07dfb4e190fd81e69197d28a6f27e53766fd1ae02d58b91618245ade706ed54c7625726f41c3a47afdd8
SSDEEP 768:IMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:IbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 72KB
SHA256 31dad8155120af4f4a7b1a516f1ae7e31061094d781b2cd9499416beb0c913b5
MD5 46904ed5d0896d6e15741ba62f875ff9
SHA1 f250af9c32e83e4dd69533380cd9ee8c9fe16cbd
SHA512 021cd5dc683ce134a4fb6a7f8ac35783d8e30b333e6be3bd7f7ae1e39732032f04a6add3e90f8061f11f3652dd6d1e461ea59354bde169717f313a0b4193527e
SSDEEP 768:tMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:tbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads