neconyd | 0e04700c509236e50aff1db22bdf013d21435e0480df5a3a0e3ec3ccf9fc09cd

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe
Size 68KB
Sample240612-2vvkhaxfql
SHA256 0e04700c509236e50aff1db22bdf013d21435e0480df5a3a0e3ec3ccf9fc09cd
MD5 4aba5650effc99e87bde42ab77dc0790
SHA1 4baf98b52d113ab55321ec0fe30562cf7baa0b5f
SHA512 05ebc80ab1b2fb5f7d99068103676a63808be373d14c9af1c0e9f1bfdc9113c3e072bddcd2d27517d1ebc8468e784265728d28a529837f035a729ece97380011
SSDEEP 1536:5d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:ZdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
3360	omsecor.exe
2244	omsecor.exe
996	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 3360	2264	4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe	81
PID 2264 wrote to memory of 3360	2264	4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe	81
PID 2264 wrote to memory of 3360	2264	4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe	81
PID 3360 wrote to memory of 2244	3360	omsecor.exe	88
PID 3360 wrote to memory of 2244	3360	omsecor.exe	88
PID 3360 wrote to memory of 2244	3360	omsecor.exe	88
PID 2244 wrote to memory of 996	2244	omsecor.exe	89
PID 2244 wrote to memory of 996	2244	omsecor.exe	89
PID 2244 wrote to memory of 996	2244	omsecor.exe	89

C:\Users\Admin\AppData\Local\Temp\4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4aba5650effc99e87bde42ab77dc0790_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 68KB
SHA256 80f4d7574d693ad003ccafcc2a77cfb4919b56ee02042eb9e2161acbe93d0206
MD5 ecf9ab9b3a9913c82357abed3e739b0e
SHA1 9aa844cb9c2680590148fd57a00d76d02dc6c58b
SHA512 85d13cec01f3d9a1642fec200199a9cdae3b0a22072fbe3adf4dce540ed67cc4f840a57d947fe04ce6eaf8a48f50275d0fff9d299a55eccdc9ffa81ea51f1b69
SSDEEP 1536:Gd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:+dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 68KB
SHA256 8bfb75662670683792d7e4c481923ecc693125e68b95ba3f368bfcc5367c2b10
MD5 7a19f1e7fb3ba1f8e0bf8d1523c52fa6
SHA1 feac2d591f987806cfd136b8fbb54c0f9958a53e
SHA512 ba87a28cd04dc5e5edea46a42aa289d14b101f2b586849b6e26bbeeb17339f454ddd0692e811a932afc416f36fa75810fd7b2e7e596f540888882b972b4c3774
SSDEEP 1536:Vd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:ddseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 68KB
SHA256 f1442e0533d1123fa0319238af55ec44259dabc2fc1bb967c77d478cd8fedcb4
MD5 d1d044b9ee00ebdb59ede78a9b567994
SHA1 0948b795102d631549b6fa12f590373ae438a37f
SHA512 8e5839c1eec55c8f0da0be385deba36dae09267e3f0e96e06bdab4171765d9979cf69200e1b7c75164201bdde92b500d1cdba0ffe709f0645a62208dfca1d827
SSDEEP 1536:ed9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:GdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads