neconyd | 8c6f7b745147584540ae9320050598bb4ce584611a0e5b74bab9fe069dfa5e67

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
225b2436b4deeaf565844a98f3e615b0_NeikiAnalytics.exe
Size 76KB
Sample240605-bcnfcshc6z
SHA256 8c6f7b745147584540ae9320050598bb4ce584611a0e5b74bab9fe069dfa5e67
MD5 225b2436b4deeaf565844a98f3e615b0
SHA1 8cfa7b0b225f829855edeb05365bfa804e855dbe
SHA512 ed55bf204c6baf8d75d03868b74dbbb3ac15b223ef8e906d560c3ab63c0fe9a596238ebe76413d4e4300d8ee0ee81961ea83def96e60e28c779dac8333a5c1d3
SSDEEP 768:gMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:gbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4748	omsecor.exe
4432	omsecor.exe
696	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 4748	4544	225b2436b4deeaf565844a98f3e615b0_NeikiAnalytics.exe	82
PID 4544 wrote to memory of 4748	4544	225b2436b4deeaf565844a98f3e615b0_NeikiAnalytics.exe	82
PID 4544 wrote to memory of 4748	4544	225b2436b4deeaf565844a98f3e615b0_NeikiAnalytics.exe	82
PID 4748 wrote to memory of 4432	4748	omsecor.exe	96
PID 4748 wrote to memory of 4432	4748	omsecor.exe	96
PID 4748 wrote to memory of 4432	4748	omsecor.exe	96
PID 4432 wrote to memory of 696	4432	omsecor.exe	97
PID 4432 wrote to memory of 696	4432	omsecor.exe	97
PID 4432 wrote to memory of 696	4432	omsecor.exe	97

C:\Users\Admin\AppData\Local\Temp\225b2436b4deeaf565844a98f3e615b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\225b2436b4deeaf565844a98f3e615b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 b6c56ac4e3069d80bf9e42ad8d3183f1ea8351768ca06ccc14952368a0717ab3
MD5 89ba352be50814160fcda082ff4b8d5a
SHA1 e2e0edafcf0857baa2e160234a857c33e122fd95
SHA512 1eabec96113fba54e97eb1f80a33f12e30812998b8f709829fefc68dcdfc924e4f1e1eeb6bf13cc2cdc0911860433aece167907a30fb691ed0439155f128ef08
SSDEEP 768:bMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:bbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 649ee666b65f13b1946ff2bc5cf853d963a37bc8533802b0a0d141b9a9a2cde2
MD5 38edfab100f4e77a9feb843235b6875c
SHA1 765b1c251b83ed5364916362e035fe3d3a484dcc
SHA512 f837c84406c6b1a9f5d8a050c7c9dcc8a12d4bd346df8c24ad2d5876294ba2eb2bee65e9708c9efac2d655fe8adcf22a85b415b46ea2650083b344140ba6f38f
SSDEEP 768:sMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:sbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 c7f95218ed6791dcf5dccf5440092806b8c462daa0be70ff302b01aad1288826
MD5 26bfd29cc04a7f7fe70d1f405cbb57db
SHA1 3559167e7b59232f36656a3c49b91a8f2c94266a
SHA512 8420a78407b5f54f5ae129dff71dfa7d500b0d4eb15537943cb6586b388dbf23ee7a3ad3e13bad2e5981c551a3be6d4461684abb5dd068e381a4f4dc8cd7f839
SSDEEP 768:QMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:QbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads