neconyd | 697e1fe49dabfdf5b4bded392fdb6c59bfe8a8e1971343284fcf862ce2b40d3a

Analysis

max time kernel
145s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 01:17

Target

24acdcbaccf5ba33155373146d6eada0_NeikiAnalytics.exe
Size

76KB
MD5

24acdcbaccf5ba33155373146d6eada0
SHA1

c619658c5feb0d3272627739ae5348abc2e53235
SHA256

697e1fe49dabfdf5b4bded392fdb6c59bfe8a8e1971343284fcf862ce2b40d3a
SHA512

a9555871aa807103db2b5032516d9c81f7d2ba717ac64ee22bc578cf047cef2fd8fe42d36d4d39246ef3b9f9f873374a4de8f964b3f5be782e96fab9edbcd866
SSDEEP

768:dMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:dbIvYvZEyFKF6N4yS+AQmZTl/5O

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Executes dropped EXE 3 IoCs

Loads dropped DLL 6 IoCs

pid	Process
1928	24acdcbaccf5ba33155373146d6eada0_NeikiAnalytics.exe
1928	24acdcbaccf5ba33155373146d6eada0_NeikiAnalytics.exe
1692	omsecor.exe
1692	omsecor.exe
1544	omsecor.exe
1544	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1692	1928	24acdcbaccf5ba33155373146d6eada0_NeikiAnalytics.exe	28
PID 1928 wrote to memory of 1692	1928	24acdcbaccf5ba33155373146d6eada0_NeikiAnalytics.exe	28
PID 1928 wrote to memory of 1692	1928	24acdcbaccf5ba33155373146d6eada0_NeikiAnalytics.exe	28
PID 1928 wrote to memory of 1692	1928	24acdcbaccf5ba33155373146d6eada0_NeikiAnalytics.exe	28
PID 1692 wrote to memory of 1544	1692	omsecor.exe	32
PID 1692 wrote to memory of 1544	1692	omsecor.exe	32
PID 1692 wrote to memory of 1544	1692	omsecor.exe	32
PID 1692 wrote to memory of 1544	1692	omsecor.exe	32
PID 1544 wrote to memory of 1516	1544	omsecor.exe	33
PID 1544 wrote to memory of 1516	1544	omsecor.exe	33
PID 1544 wrote to memory of 1516	1544	omsecor.exe	33
PID 1544 wrote to memory of 1516	1544	omsecor.exe	33

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
a4de27cd684b43c75decc5e25147512a

SHA1
21e9ed41f98984b3d22254a230f017a6c783fd2e

SHA256
a8583405fe39876079269602ee5145756ec20a494258faf4abaedec15bf85873

SHA512
88c5010df195b254cd35697029b588387a46cb829ff579f92ce0579d3c664c6497a2a217bd04a9cd003f4c94de812d8d98b534cac18eeea21b14b7bf8eaadabd

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
615cbc2af2d6c9b5db5afa489e832457

SHA1
930b86d9be37239b34122669119cc618ecb9df7f

SHA256
0550a3d251db16586e8191358ca3f923d13935f49e51f5de5762a74c28017ebd

SHA512
9575784f6c449c2cf304dc80de7ee6a23f4ca2c4ed81f9726860d872acb8e548e43ac0131f96d2975eb3163c3819a5076f039fb3dd1a650962d6b1e58819bdf2

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
76KB

MD5
cb911adad08e48e17ae177e918be5de6

SHA1
b53a483f92bef668b8c422df70015d216441285b

SHA256
52539fa1b7f55127f59d5bf11b30e0409d8bb5373de2ba171aeb65221d3a40b4

SHA512
35f8d273f4f6be7cbdf26ce2d3555693bb1fe2a61accda0f5c049ffa2e4f16038a589ab27250e64fd81cf57fc0fdff7502726169a11f5258b6bec8b673c07eaa

Download Submit