neconyd | 42392e6938f5f1f6819c0aab15f4edf6d3c2c68fc96c64dff056f1d8d78d9753

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 01:36

Target
2cc02514a38495243bf39b0d13ea2450_NeikiAnalytics.exe
Size 88KB
Sample240607-bz8ptage34
SHA256 42392e6938f5f1f6819c0aab15f4edf6d3c2c68fc96c64dff056f1d8d78d9753
MD5 2cc02514a38495243bf39b0d13ea2450
SHA1 db176a85eb47f81549f5858e0ae9b6a7c6aa9a18
SHA512 eb0851fa9ccc41ebe5035440d00b1cd428dd5d40b451360c9d5471982eca264ea3aaecfce4048762ff656bacfe8a07aaaa19c94dd14e384180b24aa4f662029e
SSDEEP 1536:Pd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:ndseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
5076	omsecor.exe
3716	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 5076	3080	2cc02514a38495243bf39b0d13ea2450_NeikiAnalytics.exe	92
PID 3080 wrote to memory of 5076	3080	2cc02514a38495243bf39b0d13ea2450_NeikiAnalytics.exe	92
PID 3080 wrote to memory of 5076	3080	2cc02514a38495243bf39b0d13ea2450_NeikiAnalytics.exe	92
PID 5076 wrote to memory of 3716	5076	omsecor.exe	110
PID 5076 wrote to memory of 3716	5076	omsecor.exe	110
PID 5076 wrote to memory of 3716	5076	omsecor.exe	110

C:\Users\Admin\AppData\Local\Temp\2cc02514a38495243bf39b0d13ea2450_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2cc02514a38495243bf39b0d13ea2450_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4028,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
1⤵
PID:3236

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 519c64755b5cb2e2698290ad131ea37b87f4cff01fa40622dc948faece9e2090
MD5 e3b7ab3effdef3f0bd782e8712ee3445
SHA1 c96ee33467b84783b79c6e4a61872bef88c3415f
SHA512 eee326fcdb4929b66c8a11a8f88b65c88a18792d9befa964bab6196eb68203035cae459a0d367f761c28bbc7df00c3b95e525118af47c4b92855066bede6f53c
SSDEEP 1536:Hd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:vdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 fed77f1de2c85b82b2046168c9085fefb3f95542fd927a416dae7202c100c30a
MD5 4602a5324e80464ce61969461c63a658
SHA1 ba97caa6d83f4011861cb56c18585547513b1515
SHA512 be2dfaf963c59d1d8c5e97304871d56158d64c6c60c5888ce1eb43911bc6e2f36d4ffd58b815c57da610615b6567d8b0e210c9e72da72712f4f462cec6ef8837
SSDEEP 1536:Rd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:hdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download