neconyd | 593f759b4fd9511b1c41f7b47d39b8e6f56640fe9fb433be197632d228d52ece

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2024 00:35

Target

7bec506d6ed7c387188fac3ab3f6f9e0_NeikiAnalytics.exe
Size

76KB
MD5

7bec506d6ed7c387188fac3ab3f6f9e0
SHA1

090b14d975054bbce8c5f0a04f17dd3bcfddc352
SHA256

593f759b4fd9511b1c41f7b47d39b8e6f56640fe9fb433be197632d228d52ece
SHA512

870514b19355c58264d0078056bcdcfec0c65dc9f0d3b392c2af44bb14ec3e72f08e664e4c5ff01db7f8ead48a7e38003f67d44b2c55286738c7b15dd318e435
SSDEEP

1536:Hd9dseIOcE93dIvYvZEyF4EEOF6N4yS+AQmZTl/5011:vdseIOKEZEyFjEOFqTiQm5l/5011

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Executes dropped EXE 2 IoCs

Processes:

omsecor.exeomsecor.exe

pid process

1188 omsecor.exe
4888 omsecor.exe
Drops file in System32 directory 2 IoCs

Processes:

omsecor.exeomsecor.exe

description ioc process

File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe
File opened for modification C:\Windows\SysWOW64\merocz.xc6 omsecor.exe

pid	process
1188	omsecor.exe
4888	omsecor.exe

description	ioc	process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7bec506d6ed7c387188fac3ab3f6f9e0_NeikiAnalytics.exeomsecor.exe

description	pid	process	target process
PID 2432 wrote to memory of 1188	2432	7bec506d6ed7c387188fac3ab3f6f9e0_NeikiAnalytics.exe	omsecor.exe
PID 2432 wrote to memory of 1188	2432	7bec506d6ed7c387188fac3ab3f6f9e0_NeikiAnalytics.exe	omsecor.exe
PID 2432 wrote to memory of 1188	2432	7bec506d6ed7c387188fac3ab3f6f9e0_NeikiAnalytics.exe	omsecor.exe
PID 1188 wrote to memory of 4888	1188	omsecor.exe	omsecor.exe
PID 1188 wrote to memory of 4888	1188	omsecor.exe	omsecor.exe
PID 1188 wrote to memory of 4888	1188	omsecor.exe	omsecor.exe

C:\Users\Admin\AppData\Local\Temp\7bec506d6ed7c387188fac3ab3f6f9e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7bec506d6ed7c387188fac3ab3f6f9e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432

C:\Users\Admin\AppData\Roaming\omsecor.exe
Filesize
76KB

MD5
5dce5a3639f3d8a5c268e44e25b165ff

SHA1
9e7c74351a63cf3d2d135057657951dfca2bacb9

SHA256
e373b4dedc0a732dd5e8cbc73eb8359ae9ba650ef30c8221945e81a5f097cdc3

SHA512
35e75f85912d2f69f30fa980988ad3a1e77a1085cbf35059bc416eabe391b2d1db8c2c230b65ba55f66095a0469ec1e62ceb2d7e875b0da56153611acc1676ba

Download Submit
C:\Windows\SysWOW64\omsecor.exe
Filesize
76KB

MD5
dde4fb7d612ef01523045ace20ed200a

SHA1
73f4eae4e36c1dde05a02c6fe9aa2c45766db18e

SHA256
a2a7734ee7fa3e5553fe87c5c4b20d25b33b11fed67ea07ef8b5871b652e1a27

SHA512
5c95c5e1193d62b0f5cf94a8b3bb039e4fb81e62925f4caef1af1cb27dcc2e60cc3607850e100fab6585dfeb08ae8cc00ccbde0aebf4072137db9d86c38ade90

Download Submit
memory/1188-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1188-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1188-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2432-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2432-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4888-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4888-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download