neconyd | 88289563be6a7d9a3c1c704761209e1fb97e7442db4b9425de92d7108dd47669

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
231ee9821accbde9c28f65a2917b0a70_NeikiAnalytics.exe
Size 72KB
Sample240606-27menaed82
SHA256 88289563be6a7d9a3c1c704761209e1fb97e7442db4b9425de92d7108dd47669
MD5 231ee9821accbde9c28f65a2917b0a70
SHA1 dd57bc2e65a6635b587ec85204662c82f62fea83
SHA512 5bc92d9c9d57cd071d7340114c0aeea8712ef26266eec09cf1ef0a59cb9b6894e0467b8974ddf7df502d6726a7fbc51c3c795583c46f4d79b46eef416a142c48
SSDEEP 768:UMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:UbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1252	omsecor.exe
2648	omsecor.exe
2152	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1488	231ee9821accbde9c28f65a2917b0a70_NeikiAnalytics.exe
1488	231ee9821accbde9c28f65a2917b0a70_NeikiAnalytics.exe
1252	omsecor.exe
1252	omsecor.exe
2648	omsecor.exe
2648	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1252	1488	231ee9821accbde9c28f65a2917b0a70_NeikiAnalytics.exe	28
PID 1488 wrote to memory of 1252	1488	231ee9821accbde9c28f65a2917b0a70_NeikiAnalytics.exe	28
PID 1488 wrote to memory of 1252	1488	231ee9821accbde9c28f65a2917b0a70_NeikiAnalytics.exe	28
PID 1488 wrote to memory of 1252	1488	231ee9821accbde9c28f65a2917b0a70_NeikiAnalytics.exe	28
PID 1252 wrote to memory of 2648	1252	omsecor.exe	32
PID 1252 wrote to memory of 2648	1252	omsecor.exe	32
PID 1252 wrote to memory of 2648	1252	omsecor.exe	32
PID 1252 wrote to memory of 2648	1252	omsecor.exe	32
PID 2648 wrote to memory of 2152	2648	omsecor.exe	33
PID 2648 wrote to memory of 2152	2648	omsecor.exe	33
PID 2648 wrote to memory of 2152	2648	omsecor.exe	33
PID 2648 wrote to memory of 2152	2648	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\231ee9821accbde9c28f65a2917b0a70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231ee9821accbde9c28f65a2917b0a70_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 9b8e5ff95889ab2b9a152720b8a742a69c162336df2787f97b4d70df89eda64d
MD5 9dbbe7fdbc848c5f0138cdbc2c16a2c4
SHA1 9793888c00438e4067f154421097dfbc2417a6cc
SHA512 1b37311477c2a452aaf9ba9dbb9695af2fb334a59753c8ae21c11baaa2226e7023f4ccdd6b438aeb85426ad68e892a30347aa79dcbef923c7878014d2b599f27
SSDEEP 768:2MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:2bIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 96707ac49abf99056e9db047678eafec4da56e68ca61f6daff6545b4f0e17a14
MD5 f4b6bbb1d219df6345d12e6f962ebf57
SHA1 0cdd781591166931cf948bf35716684d01003557
SHA512 9f2e39995e4e2c577bbcda8901b1fc9d7d368299f3e13431e24807d99ab52cce59ec21836a7dbc818176f6b0c351bdc9d6da6b592a7ae3da83282a7e4ee2379d
SSDEEP 768:1MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:1bIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 72KB
SHA256 bc57bad2800c61cef5255ceed1a368fab0f5831be3007d7d23123e2b01a1b0f2
MD5 5ca79e8590cb13c22b1ff3380e4ed18f
SHA1 35ef2c2d9e005435c38683e52fe4a329fe9860bb
SHA512 e7156bd92ee2abe4346dc92ed1f1770a8288907d29e45cad5615727b9be1caa02d75ba0ac8c5ed2becfd5473a3b9209e1f5ff4da28e726424f35ad0a26430567
SSDEEP 768:WMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:WbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads