neconyd | d6dabb9d6deda5d4ae22b8d0d8f6e7de413ffb4ad0103bab52c9438824493724

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
385d27b99d38dfdc75bb79c3b4831a00_NeikiAnalytics.exe
Size 76KB
Sample240605-evs1cadh4s
SHA256 d6dabb9d6deda5d4ae22b8d0d8f6e7de413ffb4ad0103bab52c9438824493724
MD5 385d27b99d38dfdc75bb79c3b4831a00
SHA1 d5aa6591820a5665bc833a6d780c4ca42c2811fb
SHA512 1c981e8f5780fc116398fe65700cedfce750a9c864b4c8aaf8eebedbce7871c95edfc256ead5ace4001b634c5b41860106b1b91199f3eb8dd68670627df52693
SSDEEP 1536:od9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:YdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
956	omsecor.exe
3516	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 956	2676	385d27b99d38dfdc75bb79c3b4831a00_NeikiAnalytics.exe	81
PID 2676 wrote to memory of 956	2676	385d27b99d38dfdc75bb79c3b4831a00_NeikiAnalytics.exe	81
PID 2676 wrote to memory of 956	2676	385d27b99d38dfdc75bb79c3b4831a00_NeikiAnalytics.exe	81
PID 956 wrote to memory of 3516	956	omsecor.exe	93
PID 956 wrote to memory of 3516	956	omsecor.exe	93
PID 956 wrote to memory of 3516	956	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\385d27b99d38dfdc75bb79c3b4831a00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\385d27b99d38dfdc75bb79c3b4831a00_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 c14872f373bf2a209cb935a488c21f9af6a162012775996e185c9181e6171e5b
MD5 9da063d38e4bce539fe3f60df015e668
SHA1 7db215ef92fecbb9db7baf87013cae1bdfa1b698
SHA512 35343d3851ba479d4470673c3b0e55498bfb5d10aa74ae9be7982c10cd379a9dd0d8d58704bf31fc60d7a6630bb1b7888797ff5a149aa6ee7ea441a896e93a2f
SSDEEP 1536:3d9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:/dseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 b7821fe49172f1538757b6302a61f05509d1bd200eb533b39b203026164f7115
MD5 376054999c8e9f53b6cd1b2f1ef794ae
SHA1 123463b61f371900112f861fd8c8e5c9d2afa1d9
SHA512 09e065ec524f2a2d8d38e2e178c0c9a091dff240e0df1d76048a1a684a05808c0a694fc87df4100e04556e09e2a0a0787bf8d51b98bb93021aff7e405697c9dd
SSDEEP 1536:fd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:XdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/956-6-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/956-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/956-12-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2676-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2676-4-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3516-13-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3516-14-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads