neconyd | e957a66a54a5827aa7fb9f8b71e87393b98cb9864c6509400b21d08680bc8c08

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1b5ba58fb66ee6a08c0b20e0ed189610_NeikiAnalytics.exe
Size 84KB
Sample240605-ae5a8agg76
SHA256 e957a66a54a5827aa7fb9f8b71e87393b98cb9864c6509400b21d08680bc8c08
MD5 1b5ba58fb66ee6a08c0b20e0ed189610
SHA1 98ffe79164249be17ada2271d2fa7ba36309cbc1
SHA512 f0a982128d3b9190154f6d775e0175b89667c1b1f1b0568b781725a3906f44bc9af8f4b0bce25a0d6127ec3e2fdafe7c956efcffa83f0ab243b3908e8513ae7e
SSDEEP 1536:Kd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:KdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
3612	omsecor.exe
1444	omsecor.exe
1572	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3612	2796	1b5ba58fb66ee6a08c0b20e0ed189610_NeikiAnalytics.exe	82
PID 2796 wrote to memory of 3612	2796	1b5ba58fb66ee6a08c0b20e0ed189610_NeikiAnalytics.exe	82
PID 2796 wrote to memory of 3612	2796	1b5ba58fb66ee6a08c0b20e0ed189610_NeikiAnalytics.exe	82
PID 3612 wrote to memory of 1444	3612	omsecor.exe	95
PID 3612 wrote to memory of 1444	3612	omsecor.exe	95
PID 3612 wrote to memory of 1444	3612	omsecor.exe	95
PID 1444 wrote to memory of 1572	1444	omsecor.exe	96
PID 1444 wrote to memory of 1572	1444	omsecor.exe	96
PID 1444 wrote to memory of 1572	1444	omsecor.exe	96

C:\Users\Admin\AppData\Local\Temp\1b5ba58fb66ee6a08c0b20e0ed189610_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1b5ba58fb66ee6a08c0b20e0ed189610_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 d4035783a7da7467de45260d78176b7f2f06d92fb8ac0fb9d10d1465ccc621f8
MD5 f5b39a51d08ed08633bc727a131ff507
SHA1 b96a1e3991471db07e11857c53745a5ceff569c2
SHA512 b828a6902f64e8cc23ffd2e5444a31ada320922d33ff9a2ee6518eff9de9ba7d9ad1cb10f7870eb8f968dd8ba22356f74a5535ee019cf586c30d3abdca927db6
SSDEEP 1536:/d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:3dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 dbdc8176cf48f7b164f51b5852837b3a012b89449399ef519f9d57d40e88293f
MD5 f1cd369e167a2c2a0ab820efb0516164
SHA1 44208b98a34bbeef6447ae3680d51a26f7881409
SHA512 4eafd210617631ce62b4a99c39b53196993ba03a5051128eaf912772a1a9ca6131b2f35664147f628726977d30b756877fb5ef4f79ee9be7add33b7ef8cf60af
SSDEEP 1536:Kd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:KdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 5064bb5c60a3becc081bae18165475b24f1c76872611886a7b7b46acb398f2ae
MD5 eb3ae786dcc22b054d3f3f4ce6b8cb71
SHA1 ad9d2ed1d016413db5871670c7f81f1d52f22ca0
SHA512 32834da1e0ad5f63fc27b6c9bc4c1bbefefedb382107d8e66b02e63f19b9a843f8ace344b1425e85972e43122acdf73c61689d3805213483382a7f78c8533caa
SSDEEP 1536:3d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:/dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads