neconyd | b9ae3f7c1c219bf84e862d9588da9d34f68f1bbbff242b86c814dcbf4c1b1707

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0cbf8a08556a92c3a9b8be1a0d423a20_NeikiAnalytics.exe
Size 92KB
Sample240609-dkh7qacf8w
SHA256 b9ae3f7c1c219bf84e862d9588da9d34f68f1bbbff242b86c814dcbf4c1b1707
MD5 0cbf8a08556a92c3a9b8be1a0d423a20
SHA1 1563c750b2fb0ab92b3e61124f56ba4021fcdac8
SHA512 9c08c107a479eaf3f95ff8bcb7406fb88e69118793b7174939bfc1b34bf2bead3ca21041addcb331f90f5b8fc12d6b6a9e3009a6d6dff90dc4c15e8a29dfe875
SSDEEP 768:wMTIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:wUIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
3032	omsecor.exe
3844	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 3032	3020	0cbf8a08556a92c3a9b8be1a0d423a20_NeikiAnalytics.exe	81
PID 3020 wrote to memory of 3032	3020	0cbf8a08556a92c3a9b8be1a0d423a20_NeikiAnalytics.exe	81
PID 3020 wrote to memory of 3032	3020	0cbf8a08556a92c3a9b8be1a0d423a20_NeikiAnalytics.exe	81
PID 3032 wrote to memory of 3844	3032	omsecor.exe	93
PID 3032 wrote to memory of 3844	3032	omsecor.exe	93
PID 3032 wrote to memory of 3844	3032	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\0cbf8a08556a92c3a9b8be1a0d423a20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0cbf8a08556a92c3a9b8be1a0d423a20_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 c302add7b955f5381fc1a3c1eeac1f54e6929d38e12caa15ccbb130a50356eda
MD5 66666358dc85a10bb342681b6811942f
SHA1 ba53910509bc01f73a9a97aab3a66e935774f55d
SHA512 68d7392288d667759aaa520c32cab2bdfb37826f9d32f3834f96fd3adc07715beb779e8ccd46d5586cf7f1b698ad971e217acba1e10a51bdea8718b0c134a942
SSDEEP 768:YMTIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:YUIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 92KB
SHA256 511ee3bc0daf8331249374323f1b489782768d85f9eb05d1037805fea0231681
MD5 ec9297108db0b0729a7f656009ee53be
SHA1 f8d6a3279893a43c79731bda31691006e3bb43af
SHA512 1142dd43ce9a2fd0b7db09b5752e1ab781cb4157b32c90b9dbd6e2a1ec7ef27ca928d61b6eadd1772d16be536af60b694ce233a12efd816561e30c8792e3f076
SSDEEP 768:/MTIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:/UIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3020-4-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3020-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3032-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3032-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3032-12-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3844-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3844-14-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads