neconyd | c159b55c5d9015a74101c2e829275c341c20cb0da9cb30e1a47e7c13b3059ba7

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
56e469b1d255211042e188ee2e31b550_NeikiAnalytics.exe
Size 92KB
Sample240605-q2pr2sgh71
SHA256 c159b55c5d9015a74101c2e829275c341c20cb0da9cb30e1a47e7c13b3059ba7
MD5 56e469b1d255211042e188ee2e31b550
SHA1 4d4dc1f1a9d1a2c7cf61e3372a04e660f654e774
SHA512 d2584f18fc8e41de9ed11754c37e1d3f262d4c311fa195b8c2e85928b658a5e4dd8c318f5823272bd0d34e91769e02465454d1f70b4f4040d8890fc1e5b4efff
SSDEEP 1536:Ed9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5:8dseIOyEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4960	omsecor.exe
4876	omsecor.exe
2804	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 4960	4476	56e469b1d255211042e188ee2e31b550_NeikiAnalytics.exe	83
PID 4476 wrote to memory of 4960	4476	56e469b1d255211042e188ee2e31b550_NeikiAnalytics.exe	83
PID 4476 wrote to memory of 4960	4476	56e469b1d255211042e188ee2e31b550_NeikiAnalytics.exe	83
PID 4960 wrote to memory of 4876	4960	omsecor.exe	93
PID 4960 wrote to memory of 4876	4960	omsecor.exe	93
PID 4960 wrote to memory of 4876	4960	omsecor.exe	93
PID 4876 wrote to memory of 2804	4876	omsecor.exe	94
PID 4876 wrote to memory of 2804	4876	omsecor.exe	94
PID 4876 wrote to memory of 2804	4876	omsecor.exe	94

C:\Users\Admin\AppData\Local\Temp\56e469b1d255211042e188ee2e31b550_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\56e469b1d255211042e188ee2e31b550_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 4f1890fb93db885ebfa66a0a21dc3e52797ee43d4f2b60c4380668aef45d7751
MD5 842d116b4f2a57489545bbef400f1697
SHA1 c404f2d3c916a39e83fc7d0e0cf0dbefa2f2b5c8
SHA512 036c36d3c030880922773635b4663fa70b7a132f2008cd591d5f2ede0017a8e7378742214bf93feb4dac9003d5f598ca45a41126373a0c5d5ca411dccb526910
SSDEEP 1536:Jd9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5:JdseIOyEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 185cb217ebee37f669f60a9ef3194abbe40d8ecd4c4af1a8e00272ab83371cd0
MD5 638f5ebc5714c3e7c130605bc65f36fc
SHA1 6a57ea334780b9baba55d2e52280f3e4916f0e83
SHA512 03820ff6cad7f26b722a686e69dc5f0e4017715530d95b1b2581eb8f1492fbeeddf820b4fc0e2b195151a608aa4e2b19bb55c50171c12970eef5e557cd968260
SSDEEP 1536:Nd9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5:ldseIOyEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 92KB
SHA256 43140448b9d888defed2a533ffb12e817efa513ae129228b52cd4261630e6c0d
MD5 681105ef0f8db606c0c32c4be375d7d8
SHA1 1834a3d5e29de2806023bb44f04f999f411e89dd
SHA512 5c1f9b27a6ad48d7162c9509f8d89bbf67ba0098aeb99672f9f626a84d2f8c18451bf30a9b517b0287a4d4578ac38d24408c06a429ad0524c03666c35faf511c
SSDEEP 1536:Fd9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5:tdseIOyEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2804-19-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2804-20-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4476-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4476-5-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4876-11-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4876-17-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4960-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4960-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4960-12-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads