neconyd | 9658f6f042e5c7e4c633e8bea56a7aa014b94fda824e1dbba91bb1d238c92fdc

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2fb283e5cb75deb3bef4cfb014ddba00_NeikiAnalytics.exe
Size 65KB
Sample240604-fl2rkaed88
SHA256 9658f6f042e5c7e4c633e8bea56a7aa014b94fda824e1dbba91bb1d238c92fdc
MD5 2fb283e5cb75deb3bef4cfb014ddba00
SHA1 a19c8995b8f95cfaf9125dc61515dd4ca5bf6aec
SHA512 3467e0faecafa737e4f64569ece17daceafb1f174d32ef859c8c723e4eb2cba140b45fc183c5b967d9346acfa9c1c6129e474f1ac82eb4d5dc3f26a133546c40
SSDEEP 1536:ed9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZcl/5:GdseIO+EZEyFjEOFqTiQmOl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4700	omsecor.exe
2196	omsecor.exe
3884	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 4700	1100	2fb283e5cb75deb3bef4cfb014ddba00_NeikiAnalytics.exe	89
PID 1100 wrote to memory of 4700	1100	2fb283e5cb75deb3bef4cfb014ddba00_NeikiAnalytics.exe	89
PID 1100 wrote to memory of 4700	1100	2fb283e5cb75deb3bef4cfb014ddba00_NeikiAnalytics.exe	89
PID 4700 wrote to memory of 2196	4700	omsecor.exe	110
PID 4700 wrote to memory of 2196	4700	omsecor.exe	110
PID 4700 wrote to memory of 2196	4700	omsecor.exe	110
PID 2196 wrote to memory of 3884	2196	omsecor.exe	111
PID 2196 wrote to memory of 3884	2196	omsecor.exe	111
PID 2196 wrote to memory of 3884	2196	omsecor.exe	111

C:\Users\Admin\AppData\Local\Temp\2fb283e5cb75deb3bef4cfb014ddba00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2fb283e5cb75deb3bef4cfb014ddba00_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3756,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
1⤵
PID:4732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 65KB
SHA256 450913fa0f943cb3e9e5a5bfcdf651e99df29690c52c8d67f4c6ec5f2d0c3946
MD5 a0731464a432f707e70d241aa3b15373
SHA1 62d5dae13deab1cfd5acd50690651222b6fc5a7d
SHA512 1502f841d0d51869b98d66f512e702d9b54bab18a8d2594247a03eaa3d75d9b69c5838fdf1a8356799e58c5033a50447dd3b1b3193663825e7b5dd2795a5e364
SSDEEP 1536:Td9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZcl/5:TdseIO+EZEyFjEOFqTiQmOl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 65KB
SHA256 fdac7127b774eec70f5f6afe6acb099516d9d89c70be92b1a27daca56bb10404
MD5 7d18ec495430ddeb2257758638aa47dd
SHA1 aeaa49e742ad366c73c64c0b1c4f139dbfbba334
SHA512 7853b9413ddb6b0586ca5f72de33bee04c1ebd69a3cc425f99e8baf47576544ae7bf65b919aebccfceb7cd99784bc331111580cb8ccfe8d54560708c971ed5c2
SSDEEP 1536:Cd9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZcl/5:ydseIO+EZEyFjEOFqTiQmOl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 65KB
SHA256 b0036556cb76a7eb316a713cdd2b9049f4b5e551fa2e6cbbea09e48163a22e66
MD5 32c3ba90cb4ca18c44589364816a418e
SHA1 cd77e0e2b60bc8b14d5770e60e96e0473d2bbd14
SHA512 0f21ea543187665f1eaeccd7412630971cc69dc31175719747f327fc8c3380123ed37ece364d2b810d9358ecaa2e1535a840b97520f56c9e32ce99758f5a6e9d
SSDEEP 1536:vd9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZcl/5:HdseIO+EZEyFjEOFqTiQmOl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1100-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1100-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2196-13-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2196-17-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3884-18-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3884-20-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4700-6-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4700-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4700-11-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads