neconyd | f0e4b3e4934f84c0142b21fac450506f6d72420d9938002084db61faf3eda6eb

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
12fd4dbf9ee637786d4400e3b6da5c60_NeikiAnalytics.exe
Size 76KB
Sample240610-peg81sae2w
SHA256 f0e4b3e4934f84c0142b21fac450506f6d72420d9938002084db61faf3eda6eb
MD5 12fd4dbf9ee637786d4400e3b6da5c60
SHA1 c25beffb9990ae0108413599d5d884aee813fd10
SHA512 d40fbb46e8b43f17304b0089fc774ba8c240aee2d3640ff6cf350587a7318a4dede84ec3c3cf5e1f97637092858c3404837a1e29b72ecbfef55500ccd0646c10
SSDEEP 1536:Ld9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:7dseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
3044	omsecor.exe
2504	omsecor.exe
1676	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2396	12fd4dbf9ee637786d4400e3b6da5c60_NeikiAnalytics.exe
2396	12fd4dbf9ee637786d4400e3b6da5c60_NeikiAnalytics.exe
3044	omsecor.exe
3044	omsecor.exe
2504	omsecor.exe
2504	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 3044	2396	12fd4dbf9ee637786d4400e3b6da5c60_NeikiAnalytics.exe	28
PID 2396 wrote to memory of 3044	2396	12fd4dbf9ee637786d4400e3b6da5c60_NeikiAnalytics.exe	28
PID 2396 wrote to memory of 3044	2396	12fd4dbf9ee637786d4400e3b6da5c60_NeikiAnalytics.exe	28
PID 2396 wrote to memory of 3044	2396	12fd4dbf9ee637786d4400e3b6da5c60_NeikiAnalytics.exe	28
PID 3044 wrote to memory of 2504	3044	omsecor.exe	32
PID 3044 wrote to memory of 2504	3044	omsecor.exe	32
PID 3044 wrote to memory of 2504	3044	omsecor.exe	32
PID 3044 wrote to memory of 2504	3044	omsecor.exe	32
PID 2504 wrote to memory of 1676	2504	omsecor.exe	33
PID 2504 wrote to memory of 1676	2504	omsecor.exe	33
PID 2504 wrote to memory of 1676	2504	omsecor.exe	33
PID 2504 wrote to memory of 1676	2504	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\12fd4dbf9ee637786d4400e3b6da5c60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\12fd4dbf9ee637786d4400e3b6da5c60_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 3d37eab24ce77d56b0a7e2f30e05ec94997d2ffe9f8319549adc451b4db947d9
MD5 d46bef078c398670c9eb854f6bb77ac2
SHA1 d2bbfe1d6bfe2268a3412534be73066ac59894ab
SHA512 2c72cef8440cf95f417583b04da9c43d67ac5723217fbac4c7bc7794c1442035935f0bfa2d03d0235b4bfa5fee035a5d28f6b3e2156eaff6bd3fa49d2fe77670
SSDEEP 1536:3d9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:/dseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 72b9abe93c679237439d6adcef01ab8849759436ef6d4f7b3b32fe1b6108c01e
MD5 69ccdf17c26e4fdf30723c316c74d096
SHA1 4bddd7be4670bc6a09d357c9ad1592050852ca15
SHA512 c4cd367f6e60f0960f8da2231e9a14acab9016c4f1926258430c940eddeeb6aef052943c83921556023a192902d71db578d4640fbc80ad9738619a0a2cbac9c1
SSDEEP 1536:Td9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:TdseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 af899613ae518f78aaac4b7e9c28df19946a6afc97fe918b28f4f77a10d6f5c2
MD5 f0e867c341eea1998b98a4c58d1ea53d
SHA1 5c03a6025db6ee0f61fe1f63410dbe1da797a5f4
SHA512 754d6d47e2b47f6279ef17a70fa76fd16709b71cc6b686799514151060305d0ec8d9dc0139dc166de637a627f1302a6f55363b79679af52f878d2581aec5c445
SSDEEP 1536:yd9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:CdseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1676-40-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1676-38-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2396-14-0x00000000002B0000-0x00000000002DA000-memory.dmp

Download

memory/2396-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2396-8-0x00000000002B0000-0x00000000002DA000-memory.dmp

Download

memory/2396-9-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2396-10-0x00000000002B0000-0x00000000002DA000-memory.dmp

Download

memory/2504-30-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3044-15-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3044-12-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3044-20-0x0000000000280000-0x00000000002AA000-memory.dmp

Download

memory/3044-26-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads