neconyd | 53cf83eb30112048559f08c9be5f2be04e300e513fd110b078abd30fb0ce7ebd

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
88977272fde6213bc203b81dc27f25a0_NeikiAnalytics.exe
Size 96KB
Sample240613-1ch83svblm
SHA256 53cf83eb30112048559f08c9be5f2be04e300e513fd110b078abd30fb0ce7ebd
MD5 88977272fde6213bc203b81dc27f25a0
SHA1 15dc838b7f50547779e4043ec1952e3b938d23ba
SHA512 066b5125f749083a42de75cd72de2dcc33d465b17939ea6043e6d787eb97f23bcae429404514b565c7096990bc69bda9f142cc65940e149ca39d39568b4a42c5
SSDEEP 1536:VnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:VGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
932	omsecor.exe
3912	omsecor.exe
1068	omsecor.exe
3712	omsecor.exe
3476	omsecor.exe
396	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1900 set thread context of 1176	1900	88977272fde6213bc203b81dc27f25a0_NeikiAnalytics.exe	81
PID 932 set thread context of 3912	932	omsecor.exe	85
PID 1068 set thread context of 3712	1068	omsecor.exe	97
PID 3476 set thread context of 396	3476	omsecor.exe	101

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1180	1900	WerFault.exe	80
3236	932	WerFault.exe	83
2388	1068	WerFault.exe	96
1376	3476	WerFault.exe	99

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1176	1900	88977272fde6213bc203b81dc27f25a0_NeikiAnalytics.exe	81
PID 1900 wrote to memory of 1176	1900	88977272fde6213bc203b81dc27f25a0_NeikiAnalytics.exe	81
PID 1900 wrote to memory of 1176	1900	88977272fde6213bc203b81dc27f25a0_NeikiAnalytics.exe	81
PID 1900 wrote to memory of 1176	1900	88977272fde6213bc203b81dc27f25a0_NeikiAnalytics.exe	81
PID 1900 wrote to memory of 1176	1900	88977272fde6213bc203b81dc27f25a0_NeikiAnalytics.exe	81
PID 1176 wrote to memory of 932	1176	88977272fde6213bc203b81dc27f25a0_NeikiAnalytics.exe	83
PID 1176 wrote to memory of 932	1176	88977272fde6213bc203b81dc27f25a0_NeikiAnalytics.exe	83
PID 1176 wrote to memory of 932	1176	88977272fde6213bc203b81dc27f25a0_NeikiAnalytics.exe	83
PID 932 wrote to memory of 3912	932	omsecor.exe	85
PID 932 wrote to memory of 3912	932	omsecor.exe	85
PID 932 wrote to memory of 3912	932	omsecor.exe	85
PID 932 wrote to memory of 3912	932	omsecor.exe	85
PID 932 wrote to memory of 3912	932	omsecor.exe	85
PID 3912 wrote to memory of 1068	3912	omsecor.exe	96
PID 3912 wrote to memory of 1068	3912	omsecor.exe	96
PID 3912 wrote to memory of 1068	3912	omsecor.exe	96
PID 1068 wrote to memory of 3712	1068	omsecor.exe	97
PID 1068 wrote to memory of 3712	1068	omsecor.exe	97
PID 1068 wrote to memory of 3712	1068	omsecor.exe	97
PID 1068 wrote to memory of 3712	1068	omsecor.exe	97
PID 1068 wrote to memory of 3712	1068	omsecor.exe	97
PID 3712 wrote to memory of 3476	3712	omsecor.exe	99
PID 3712 wrote to memory of 3476	3712	omsecor.exe	99
PID 3712 wrote to memory of 3476	3712	omsecor.exe	99
PID 3476 wrote to memory of 396	3476	omsecor.exe	101
PID 3476 wrote to memory of 396	3476	omsecor.exe	101
PID 3476 wrote to memory of 396	3476	omsecor.exe	101
PID 3476 wrote to memory of 396	3476	omsecor.exe	101
PID 3476 wrote to memory of 396	3476	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\88977272fde6213bc203b81dc27f25a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\88977272fde6213bc203b81dc27f25a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Local\Temp\88977272fde6213bc203b81dc27f25a0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\88977272fde6213bc203b81dc27f25a0_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1068
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 256
        8⤵
        Program crash
        
        PID:1376
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 296
        6⤵
        Program crash
        
        PID:2388
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 300
      4⤵
      Program crash
      PID:3236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 288
  2⤵
  - Program crash
  PID:1180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1900 -ip 1900
1⤵
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 932 -ip 932
1⤵
PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1068 -ip 1068
1⤵
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3476 -ip 3476
1⤵
PID:4440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 b5d3ef68acd150bb4506a992e5a1e06cc82427e46e8030d9bf8b2f354b29056f
MD5 9cb3b0e02dff3e5c5149914780adf61b
SHA1 4cebaf496fbee508f882f0f7917a092dc2b3e8cf
SHA512 aa07e8eb9d6b8a422ac19c40754b8ac47df34f5fe6210829d1b6f479650b4a42d34499b5268cb2c3e324a502959746a6b73a6c22ba5547161a0b51df56d679b6
SSDEEP 1536:XnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:XGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 0cb4f3d49899034dc15f6fe64bf74c2cfb215375c891eefc746656c831101e8f
MD5 cc3fcea740318ca1ba6b3754c2510f91
SHA1 1a347acb49439ee9d4eb8d93d9775989f9340547
SHA512 c26e32d2a48b77be8eb995a99f8a0c3b693655eb392327943e0d1552d5e194a77df03c3016bf1a5c954300b7784b6a6329b7880ae2f3a4ad05ce8f98f724417f
SSDEEP 1536:xnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:xGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 296ee56e1910586259c2334906ac054bca29bcca643345b8a3e86eaeab778388
MD5 2fa2a9d5ff6dc1c7dce898b72e423640
SHA1 474d08cbecc4caf0861d2782e51df1efa69d18ec
SHA512 844dc448dcfb75772a659d4e58d37e393b2b395b5365bffce62e6f0e6c71c11724feae6f7712de30a0de3313aeed5f2a7cc9a3aa4054302bafcf70b3ca375359
SSDEEP 1536:4nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:4Gs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/396-55-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/396-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/396-51-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/396-58-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/932-10-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/932-19-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1068-53-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1068-34-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1176-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1176-9-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1176-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1176-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1900-18-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1900-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3476-45-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3712-43-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3712-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3712-38-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3912-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3912-31-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3912-27-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3912-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3912-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3912-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3912-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads