neconyd | 59d80e909f694f3a60be98c013a178533659164fc655928ff6a29f337d1bcf82

Analysis

max time kernel
142s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2b7f555bbecdcd659eb50d196d48760_NeikiAnalytics.exe
Size 64KB
Sample240614-e9sccsyhpp
SHA256 59d80e909f694f3a60be98c013a178533659164fc655928ff6a29f337d1bcf82
MD5 a2b7f555bbecdcd659eb50d196d48760
SHA1 e367b914d4b0831dd408d2c962ee6e4d8c25064a
SHA512 617b151ce596818cde3e510b9ffdfe577f305c8679df82614ec681d41542c1c190b8f1697aa6073404f440ae732b5dbc214122f66a92dac9408b4052fffd9f74
SSDEEP 768:GMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:GbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2484	omsecor.exe
4392	omsecor.exe
3580	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 2484	4352	a2b7f555bbecdcd659eb50d196d48760_NeikiAnalytics.exe	81
PID 4352 wrote to memory of 2484	4352	a2b7f555bbecdcd659eb50d196d48760_NeikiAnalytics.exe	81
PID 4352 wrote to memory of 2484	4352	a2b7f555bbecdcd659eb50d196d48760_NeikiAnalytics.exe	81
PID 2484 wrote to memory of 4392	2484	omsecor.exe	92
PID 2484 wrote to memory of 4392	2484	omsecor.exe	92
PID 2484 wrote to memory of 4392	2484	omsecor.exe	92
PID 4392 wrote to memory of 3580	4392	omsecor.exe	93
PID 4392 wrote to memory of 3580	4392	omsecor.exe	93
PID 4392 wrote to memory of 3580	4392	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\a2b7f555bbecdcd659eb50d196d48760_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a2b7f555bbecdcd659eb50d196d48760_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 7238775a7cbf6812281594ce4207799401c1f8b00805be606d5897dea525a80b
MD5 a11fe8ae25761ddf72f854a833baa679
SHA1 46943e2faee82f1bd341e74fb3990d4fa37509f1
SHA512 0c8c0218cf8d58b16fcd788eff5ae41a8c1bdaa081df619652cd7f868935250be533c55e722d1f4fdcd0b15de68d542f54c8ef623bfac97da2aed6f567ef50e0
SSDEEP 768:cMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:cbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 4dbbe142381531f1d5c98674d95f9c2ef3fdeec84ee25e560f6192a394c17d8f
MD5 92d86ee31a04ede6d6fd8034043a10f7
SHA1 7d8f32d68346c407f980f6dfefd0c708f2c4f076
SHA512 d219a83ded690cd4aa672d110511aefd6e3ce32dcfa54b3ea544e7638ddf3df0f8277a9f829d364f107c379cd99a71ae0600f9b703875fb14c74e8d7cc98e226
SSDEEP 768:RMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:RbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 64KB
SHA256 5dba71cca6ae5a1b3f1da8400a99af674d70424ea8f16230c6443c2113941856
MD5 d29d8f113cbce4cae3da1f92911f7873
SHA1 c409a1c412bf539aa46cb996da99df307382ff64
SHA512 35b85dce94f0c12f5bcdc1a68f88476fd914f1febc838c3347b1acb327bd6d5f24ed10fb42aa778c4934a89dd4a190e630b9515b09f5bee1f63fa916629d5cba
SSDEEP 768:EMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:EbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads