neconyd | 57fd5519d7e89d811e607ad0f1d3c58d453aa53f445ac6d4118095d298968b1b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 23:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1f6d5672f8c369bebb0e96ce591cc9c0_NeikiAnalytics.exe
Size 76KB
Sample240610-3nar7avgjd
SHA256 57fd5519d7e89d811e607ad0f1d3c58d453aa53f445ac6d4118095d298968b1b
MD5 1f6d5672f8c369bebb0e96ce591cc9c0
SHA1 59f34fae915d47d70c0e7a34d880dc117a2ac7b0
SHA512 59faff7abc12121c320268ccc1d32c360765f1caf3e718ac5e63f3d8920ebd244050697fc6a37312011e2ef1ea74423122d0b289a7c7698bb75a7f76b0b94c94
SSDEEP 1536:0d9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:MdseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1456	omsecor.exe
3164	omsecor.exe
4252	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 1456	4728	1f6d5672f8c369bebb0e96ce591cc9c0_NeikiAnalytics.exe	89
PID 4728 wrote to memory of 1456	4728	1f6d5672f8c369bebb0e96ce591cc9c0_NeikiAnalytics.exe	89
PID 4728 wrote to memory of 1456	4728	1f6d5672f8c369bebb0e96ce591cc9c0_NeikiAnalytics.exe	89
PID 1456 wrote to memory of 3164	1456	omsecor.exe	103
PID 1456 wrote to memory of 3164	1456	omsecor.exe	103
PID 1456 wrote to memory of 3164	1456	omsecor.exe	103
PID 3164 wrote to memory of 4252	3164	omsecor.exe	104
PID 3164 wrote to memory of 4252	3164	omsecor.exe	104
PID 3164 wrote to memory of 4252	3164	omsecor.exe	104

C:\Users\Admin\AppData\Local\Temp\1f6d5672f8c369bebb0e96ce591cc9c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1f6d5672f8c369bebb0e96ce591cc9c0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4204,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
1⤵
PID:4068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 877c7b17049cf32dfc3325d386dbde12211341c740b9831e3358bf763da1253e
MD5 6670593b09fca574d25bdbeca45d03d3
SHA1 8a03d8dac74db29a4a8cdd141b532ae16369f13b
SHA512 de82cb7910be611e7a6966a387b25aebda4e0d5a8a38c57d3411a473adfb31c6c662f11a062b34d1c3a395b3f01b03e03a7885e6e9745bb6787033970dcea3e5
SSDEEP 1536:Kd9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:KdseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 d597023c0cf456248451c61c0110df2cf7605e055a210af8ec846f4b4d627bec
MD5 1481c4b335a4844c661fd6d7b7381523
SHA1 01dd23e334ea4298c932ecaba27affd538dfa8b6
SHA512 5eaeebe208e97bd62f6dd71270162c11652c0bb9e517a612c71e8f569df092bb32bd9f334aad3be869c04b7b31fed35198e75f8947af519087db178f202b0f68
SSDEEP 1536:zd9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:zdseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 3090ac2247b8ed33576b3cffea388efaf5caab3136e846692091e89cbd4bc0b5
MD5 94e75237ad8547ff5b22e0e739e2436b
SHA1 1ccc80f09d44795604b73763d4f1e3761dc9b781
SHA512 ef9dee771a5a8e99ef6870f81337cc675a56b6cd681c413b23b510ed2dae4ed7be9f3cea0a15e0a5106604dfe67836ec4c0474409995f6c30ca60ffc2e1d4e53
SSDEEP 1536:id9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:SdseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1456-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1456-6-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1456-11-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3164-12-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3164-16-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4252-17-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4252-19-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4728-1-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads