neconyd | 247f467b3ae57db89d7fed7478f99acbb73a89baf663ca6957704b5e37a357af

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14e858561217312780245e5937c33870_NeikiAnalytics.exe
Size 96KB
Sample240606-pxynqaec4s
SHA256 247f467b3ae57db89d7fed7478f99acbb73a89baf663ca6957704b5e37a357af
MD5 14e858561217312780245e5937c33870
SHA1 56c9389653490f3a4cb7d01c1ec9cb5c43ce3fb1
SHA512 7314f4736b3f50ee680fdab6a137414a2c815e8b4b6814ca98c9468ad1f9f7033bb53c2b06a69c965afddc09fccf42751a38539f68dfb6b0267985e0a93ea8b5
SSDEEP 1536:lnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:lGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
2984	omsecor.exe
2856	omsecor.exe
1848	omsecor.exe
1628	omsecor.exe
1780	omsecor.exe
2336	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2000	14e858561217312780245e5937c33870_NeikiAnalytics.exe
2000	14e858561217312780245e5937c33870_NeikiAnalytics.exe
2984	omsecor.exe
2856	omsecor.exe
2856	omsecor.exe
1628	omsecor.exe
1628	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2784 set thread context of 2000	2784	14e858561217312780245e5937c33870_NeikiAnalytics.exe	28
PID 2984 set thread context of 2856	2984	omsecor.exe	30
PID 1848 set thread context of 1628	1848	omsecor.exe	35
PID 1780 set thread context of 2336	1780	omsecor.exe	37

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2000	2784	14e858561217312780245e5937c33870_NeikiAnalytics.exe	28
PID 2784 wrote to memory of 2000	2784	14e858561217312780245e5937c33870_NeikiAnalytics.exe	28
PID 2784 wrote to memory of 2000	2784	14e858561217312780245e5937c33870_NeikiAnalytics.exe	28
PID 2784 wrote to memory of 2000	2784	14e858561217312780245e5937c33870_NeikiAnalytics.exe	28
PID 2784 wrote to memory of 2000	2784	14e858561217312780245e5937c33870_NeikiAnalytics.exe	28
PID 2784 wrote to memory of 2000	2784	14e858561217312780245e5937c33870_NeikiAnalytics.exe	28
PID 2000 wrote to memory of 2984	2000	14e858561217312780245e5937c33870_NeikiAnalytics.exe	29
PID 2000 wrote to memory of 2984	2000	14e858561217312780245e5937c33870_NeikiAnalytics.exe	29
PID 2000 wrote to memory of 2984	2000	14e858561217312780245e5937c33870_NeikiAnalytics.exe	29
PID 2000 wrote to memory of 2984	2000	14e858561217312780245e5937c33870_NeikiAnalytics.exe	29
PID 2984 wrote to memory of 2856	2984	omsecor.exe	30
PID 2984 wrote to memory of 2856	2984	omsecor.exe	30
PID 2984 wrote to memory of 2856	2984	omsecor.exe	30
PID 2984 wrote to memory of 2856	2984	omsecor.exe	30
PID 2984 wrote to memory of 2856	2984	omsecor.exe	30
PID 2984 wrote to memory of 2856	2984	omsecor.exe	30
PID 2856 wrote to memory of 1848	2856	omsecor.exe	34
PID 2856 wrote to memory of 1848	2856	omsecor.exe	34
PID 2856 wrote to memory of 1848	2856	omsecor.exe	34
PID 2856 wrote to memory of 1848	2856	omsecor.exe	34
PID 1848 wrote to memory of 1628	1848	omsecor.exe	35
PID 1848 wrote to memory of 1628	1848	omsecor.exe	35
PID 1848 wrote to memory of 1628	1848	omsecor.exe	35
PID 1848 wrote to memory of 1628	1848	omsecor.exe	35
PID 1848 wrote to memory of 1628	1848	omsecor.exe	35
PID 1848 wrote to memory of 1628	1848	omsecor.exe	35
PID 1628 wrote to memory of 1780	1628	omsecor.exe	36
PID 1628 wrote to memory of 1780	1628	omsecor.exe	36
PID 1628 wrote to memory of 1780	1628	omsecor.exe	36
PID 1628 wrote to memory of 1780	1628	omsecor.exe	36
PID 1780 wrote to memory of 2336	1780	omsecor.exe	37
PID 1780 wrote to memory of 2336	1780	omsecor.exe	37
PID 1780 wrote to memory of 2336	1780	omsecor.exe	37
PID 1780 wrote to memory of 2336	1780	omsecor.exe	37
PID 1780 wrote to memory of 2336	1780	omsecor.exe	37
PID 1780 wrote to memory of 2336	1780	omsecor.exe	37

C:\Users\Admin\AppData\Local\Temp\14e858561217312780245e5937c33870_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\14e858561217312780245e5937c33870_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Users\Admin\AppData\Local\Temp\14e858561217312780245e5937c33870_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\14e858561217312780245e5937c33870_NeikiAnalytics.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2856
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1848
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1628
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:2336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 c091c72cd30c7a044b47d2e7929a238d2b795345df76aed3b2677a7ff5093e70
MD5 ffaae67b11fae2c00fe995be21271fde
SHA1 e88ecdedf05210bc47ddd0549e100b0a2612ba91
SHA512 b7b3a0cd96a482ce636316c30c98353e767c472ea80771967910a9b9ae881705a9d23da0f4040a25872527b60e1bb7ab8f9f15fd6d89af95d6f2de9554dc0eb8
SSDEEP 1536:cnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:cGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 ae89592e0326f2c5163a78f9bce9f535fbefff08d864d55c7f1443d0c60be553
MD5 cfcaed4c85db77679c6b2055c1640601
SHA1 ec439afaf2cebcbb357ea9b207b6f7608a9619c4
SHA512 a796c3d5550d964921afd1cab44a9e96c2dcbf589bbef7bffa757cbb4489507d251e934b85a731e991859a08db4bb3727c0fa1d0bb8a26a2e4fa84ee0e52b914
SSDEEP 1536:HnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:HGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 f5e77b4188f8b1e4970991b2daeee062a462a2bc59555769e2b5d6f3d5244b4b
MD5 737ff15151b6ae4f2028fa05d0584213
SHA1 0c3fe7f5770ff8cb5a558a8c08539cd233ca9b0c
SHA512 c6dee5cf56a124edfb0d95d928caeaa9049a4af4925ec520294b41a54c7214fb918a441cd16192fe44440a1dacda22ddd40725d3efc87d75a7aa40048ead6674
SSDEEP 1536:PnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:PGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1628-71-0x00000000003D0000-0x00000000003F3000-memory.dmp

Download

memory/1780-87-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1780-79-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1848-64-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1848-56-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2000-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2000-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2000-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2000-9-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2000-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2336-89-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2336-92-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2784-7-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2784-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2856-54-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2856-46-0x00000000003B0000-0x00000000003D3000-memory.dmp

Download

memory/2856-43-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2856-40-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2856-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2856-34-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2984-31-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2984-21-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads