neconyd | a54a7e809bb516694c642fc491907c7b429cc21578cd22a849c0ce077a46b1e1

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a5d387cab86f24baa35a620be24f960_NeikiAnalytics.exe
Size 80KB
Sample240604-eg6dhscc6x
SHA256 a54a7e809bb516694c642fc491907c7b429cc21578cd22a849c0ce077a46b1e1
MD5 2a5d387cab86f24baa35a620be24f960
SHA1 bba783748da6faceab6815ccbdbf8b53ad1b70cd
SHA512 edddf18b4990c491eaf34af3fb8d2080cb214ced8188ed6d3bddc3b8751f3b6fe5fddcd2a818d9ab17e09e8af7dedc75d52739f39571daac971a511efefc1c27
SSDEEP 768:ufMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:ufbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1696	omsecor.exe
224	omsecor.exe
4348	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1696	1080	2a5d387cab86f24baa35a620be24f960_NeikiAnalytics.exe	82
PID 1080 wrote to memory of 1696	1080	2a5d387cab86f24baa35a620be24f960_NeikiAnalytics.exe	82
PID 1080 wrote to memory of 1696	1080	2a5d387cab86f24baa35a620be24f960_NeikiAnalytics.exe	82
PID 1696 wrote to memory of 224	1696	omsecor.exe	94
PID 1696 wrote to memory of 224	1696	omsecor.exe	94
PID 1696 wrote to memory of 224	1696	omsecor.exe	94
PID 224 wrote to memory of 4348	224	omsecor.exe	95
PID 224 wrote to memory of 4348	224	omsecor.exe	95
PID 224 wrote to memory of 4348	224	omsecor.exe	95

C:\Users\Admin\AppData\Local\Temp\2a5d387cab86f24baa35a620be24f960_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2a5d387cab86f24baa35a620be24f960_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 80KB
SHA256 7bba2862724148e29d741d39bf5763eef35862e7c9ee892d4c2aead0e863051b
MD5 05ac051ec981434a05a051ab5819b751
SHA1 9cb47f81ac14e8c841a20f8a247a9724047b9167
SHA512 5f6b853c179af54944ebc2c7b6c29fef5a36d8897582d6dc1ca8f2d166bce31414d7cc8dee8987405a8e183bb78e3629a37743479b568dc8968bdf05974643f9
SSDEEP 768:DfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:DfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 80KB
SHA256 5b0fefb20fba5a7ce5605b06be0c8b8d1f5cc54b4b7d0734739b6d673464a1ea
MD5 eb5f2860ccdaf70a68baaf7a17e94f82
SHA1 d55750ac94bfa84cc084b85c035529d05dc30099
SHA512 c4776a675015ab050836f346f26905c148dd4072dffc4a8ec08a17a7735ca5e531122593bc72be7deb69cb3921eb78bbd3f19608401c8f806fa157e7c3a6602d
SSDEEP 768:+fMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:+fbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 80KB
SHA256 75193517d00f52227932c58ade6992a85bac5ec0058fce3d272e49883af84b40
MD5 14af481cc613772d2e25fc5f72b20390
SHA1 3083e47550ded35eef14fffdadb9f78f403d02ca
SHA512 0f5bd5151f07f43ed4faaf555533929615857b29fbc06657a7c4f1f77632a2e4c6e5857819ad2d9251c103a3bd75d3d21aa72e35f07d71fee92c17276924ce49
SSDEEP 768:bfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:bfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads