neconyd | 88289563be6a7d9a3c1c704761209e1fb97e7442db4b9425de92d7108dd47669

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
231ee9821accbde9c28f65a2917b0a70_NeikiAnalytics.exe
Size 72KB
Sample240606-27menaed82
SHA256 88289563be6a7d9a3c1c704761209e1fb97e7442db4b9425de92d7108dd47669
MD5 231ee9821accbde9c28f65a2917b0a70
SHA1 dd57bc2e65a6635b587ec85204662c82f62fea83
SHA512 5bc92d9c9d57cd071d7340114c0aeea8712ef26266eec09cf1ef0a59cb9b6894e0467b8974ddf7df502d6726a7fbc51c3c795583c46f4d79b46eef416a142c48
SSDEEP 768:UMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:UbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
3100	omsecor.exe
2376	omsecor.exe
4936	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 3100	3316	231ee9821accbde9c28f65a2917b0a70_NeikiAnalytics.exe	83
PID 3316 wrote to memory of 3100	3316	231ee9821accbde9c28f65a2917b0a70_NeikiAnalytics.exe	83
PID 3316 wrote to memory of 3100	3316	231ee9821accbde9c28f65a2917b0a70_NeikiAnalytics.exe	83
PID 3100 wrote to memory of 2376	3100	omsecor.exe	102
PID 3100 wrote to memory of 2376	3100	omsecor.exe	102
PID 3100 wrote to memory of 2376	3100	omsecor.exe	102
PID 2376 wrote to memory of 4936	2376	omsecor.exe	103
PID 2376 wrote to memory of 4936	2376	omsecor.exe	103
PID 2376 wrote to memory of 4936	2376	omsecor.exe	103

C:\Users\Admin\AppData\Local\Temp\231ee9821accbde9c28f65a2917b0a70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231ee9821accbde9c28f65a2917b0a70_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 cfba40ab6853e2ad9b9e967f49544b9699c9b47d1fbaf435581103a8f20e38cb
MD5 959717b79109751bc54e8f1d52806292
SHA1 f64723bf86d5c0a27e6c02ed6a38211a7df64e08
SHA512 2f5c7aba0f38e47bac805f7cdb8e1c32c2c82db317ae4f1e56d8d959c483e5843ad867eaa4c9f1241c1d93b73fa6a61f23a28514585326d8ef6d759a6491bc68
SSDEEP 768:HMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:HbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 96707ac49abf99056e9db047678eafec4da56e68ca61f6daff6545b4f0e17a14
MD5 f4b6bbb1d219df6345d12e6f962ebf57
SHA1 0cdd781591166931cf948bf35716684d01003557
SHA512 9f2e39995e4e2c577bbcda8901b1fc9d7d368299f3e13431e24807d99ab52cce59ec21836a7dbc818176f6b0c351bdc9d6da6b592a7ae3da83282a7e4ee2379d
SSDEEP 768:1MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:1bIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 72KB
SHA256 8be31f4740648b0babccfa040ca25b5f9b6a89b578847ba340447e891a60415e
MD5 719cf90a4bdcf586e713a9aba2f57f12
SHA1 ecd014fa0c6b996d2bbc3e69681011b21d391b28
SHA512 3a0960f7eb522d697bbcdb56e570e1b4a6671a0c7c5541a45159ae9d45bb76152d44cee765175dd6b189995976a38ff1849e51531b5ba2da9e3e5714c342276a
SSDEEP 768:bMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:bbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads