neconyd | b6246d4921e0ad94fce036593e16cc6c367f4d70abd1b6b395d2f992de3c03d6

Analysis

max time kernel
142s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 11:51

Target
3823ef3251b1aeb26497799646986580_NeikiAnalytics.exe
Size 68KB
Sample240612-nz9nbstdng
SHA256 b6246d4921e0ad94fce036593e16cc6c367f4d70abd1b6b395d2f992de3c03d6
MD5 3823ef3251b1aeb26497799646986580
SHA1 c4e8b54d5a86192969c40052ee75787604b649a5
SHA512 8047510ca8036a308ea94a69a9da91c5a3a1a0c90bdcbf1161ee7462e17b64410cac02c37d6f2ba182bc037b1b075e7faeb88a271758672e7c811e71503cbcf5
SSDEEP 1536:pd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:pdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
100	omsecor.exe
2876	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 100	5068	3823ef3251b1aeb26497799646986580_NeikiAnalytics.exe	82
PID 5068 wrote to memory of 100	5068	3823ef3251b1aeb26497799646986580_NeikiAnalytics.exe	82
PID 5068 wrote to memory of 100	5068	3823ef3251b1aeb26497799646986580_NeikiAnalytics.exe	82
PID 100 wrote to memory of 2876	100	omsecor.exe	93
PID 100 wrote to memory of 2876	100	omsecor.exe	93
PID 100 wrote to memory of 2876	100	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\3823ef3251b1aeb26497799646986580_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3823ef3251b1aeb26497799646986580_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:100
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:2876

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 68KB
SHA256 287cac6f12afd45cd39e627a77b0bbd9cd4036d8f60319bffb198e2f22f202c7
MD5 d8de4b2d2dcd377d800c0e899fa4471c
SHA1 1e50803e4b1476e2a3797092b2a4cf7a12712806
SHA512 7c2b4ffe31009405afe2d45ae79d1c35f61ccaa62c7648cbdb4c56d40b7a6598c0e03448922e8a18d97528d83e9b50f175eee0eec554e7a26eb9ee2f113524cb
SSDEEP 1536:dd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:VdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 68KB
SHA256 0b62a86e21d6c93d90f7bac171b11ee9a8e9ab5b880af53bc99705d2b5c63e39
MD5 abbca509fcce4f1518020e3d578dbb11
SHA1 4d773ce058c3ef44924a44cefe79fc836e86a63d
SHA512 dd0cfb73e6dcec8805ea54e633c40abe295e5c9bd9022b248c1bc8e02a8b48fa55fc211d37ee3ef1012cc3ca9166fe831bf525f2b6b99602b357501868f93c9e
SSDEEP 1536:Kd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:KdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download