neconyd | a54a7e809bb516694c642fc491907c7b429cc21578cd22a849c0ce077a46b1e1

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a5d387cab86f24baa35a620be24f960_NeikiAnalytics.exe
Size 80KB
Sample240604-eg6dhscc6x
SHA256 a54a7e809bb516694c642fc491907c7b429cc21578cd22a849c0ce077a46b1e1
MD5 2a5d387cab86f24baa35a620be24f960
SHA1 bba783748da6faceab6815ccbdbf8b53ad1b70cd
SHA512 edddf18b4990c491eaf34af3fb8d2080cb214ced8188ed6d3bddc3b8751f3b6fe5fddcd2a818d9ab17e09e8af7dedc75d52739f39571daac971a511efefc1c27
SSDEEP 768:ufMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:ufbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1748	omsecor.exe
1712	omsecor.exe
1796	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2308	2a5d387cab86f24baa35a620be24f960_NeikiAnalytics.exe
2308	2a5d387cab86f24baa35a620be24f960_NeikiAnalytics.exe
1748	omsecor.exe
1748	omsecor.exe
1712	omsecor.exe
1712	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1748	2308	2a5d387cab86f24baa35a620be24f960_NeikiAnalytics.exe	28
PID 2308 wrote to memory of 1748	2308	2a5d387cab86f24baa35a620be24f960_NeikiAnalytics.exe	28
PID 2308 wrote to memory of 1748	2308	2a5d387cab86f24baa35a620be24f960_NeikiAnalytics.exe	28
PID 2308 wrote to memory of 1748	2308	2a5d387cab86f24baa35a620be24f960_NeikiAnalytics.exe	28
PID 1748 wrote to memory of 1712	1748	omsecor.exe	32
PID 1748 wrote to memory of 1712	1748	omsecor.exe	32
PID 1748 wrote to memory of 1712	1748	omsecor.exe	32
PID 1748 wrote to memory of 1712	1748	omsecor.exe	32
PID 1712 wrote to memory of 1796	1712	omsecor.exe	33
PID 1712 wrote to memory of 1796	1712	omsecor.exe	33
PID 1712 wrote to memory of 1796	1712	omsecor.exe	33
PID 1712 wrote to memory of 1796	1712	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\2a5d387cab86f24baa35a620be24f960_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2a5d387cab86f24baa35a620be24f960_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 80KB
SHA256 5acaf243e167407d93b299289a5bfa36512a795da6c13cf92bdf7fbee3929d58
MD5 b1216fa11f8da50cdcac454e1005cb56
SHA1 f4aa75450f956ceb777fc85abf804e5c1122e726
SHA512 d7cd1306de556c292519ec159e12af1190e56e72271d26da06441a26f00c258e14e7d35e28163cbfa149fe394e42609663b487729a713bfdefe2bf3edb333037
SSDEEP 768:sfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:sfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 80KB
SHA256 5b0fefb20fba5a7ce5605b06be0c8b8d1f5cc54b4b7d0734739b6d673464a1ea
MD5 eb5f2860ccdaf70a68baaf7a17e94f82
SHA1 d55750ac94bfa84cc084b85c035529d05dc30099
SHA512 c4776a675015ab050836f346f26905c148dd4072dffc4a8ec08a17a7735ca5e531122593bc72be7deb69cb3921eb78bbd3f19608401c8f806fa157e7c3a6602d
SSDEEP 768:+fMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:+fbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 80KB
SHA256 beda856b5943e0e2157983b7aac1b6a593525d86ba6b67624a2180314e5c715b
MD5 3c6bd1a4465a7f8c46eb44fa698232a6
SHA1 6780a532a7ed866c0b1341e3aa00bb19525d6e97
SHA512 30d452391f5b6ccb83b38874e6f393f48d7412841af12e4ab79bb5c4c5a80677143efc5592fe56d9017e97dc237b24d8de11d84acaeef7be9187e14712d88d5f
SSDEEP 768:AfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:AfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads