neconyd | 58e9ca74d03306a409608a7b204c16130ed25c7e8e62192585a72099cec34aca

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b9813b8cdd59c9461f39f793bfb15090_NeikiAnalytics.exe
Size 84KB
Sample240614-mxjhpaxdqa
SHA256 58e9ca74d03306a409608a7b204c16130ed25c7e8e62192585a72099cec34aca
MD5 b9813b8cdd59c9461f39f793bfb15090
SHA1 d028fae7756978a38180d62e3fd1eff0236e35cd
SHA512 0956977b0236e2f2ef1084fe1af2cf59b6f730e34415368ec6acf46650c6981e67e68a42e1b4da0d86310687d8ee12db598169f1397c6fa3dbcd247698fa07e0
SSDEEP 768:yMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:ybIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4296	omsecor.exe
3272	omsecor.exe
3212	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 4296	2240	b9813b8cdd59c9461f39f793bfb15090_NeikiAnalytics.exe	90
PID 2240 wrote to memory of 4296	2240	b9813b8cdd59c9461f39f793bfb15090_NeikiAnalytics.exe	90
PID 2240 wrote to memory of 4296	2240	b9813b8cdd59c9461f39f793bfb15090_NeikiAnalytics.exe	90
PID 4296 wrote to memory of 3272	4296	omsecor.exe	101
PID 4296 wrote to memory of 3272	4296	omsecor.exe	101
PID 4296 wrote to memory of 3272	4296	omsecor.exe	101
PID 3272 wrote to memory of 3212	3272	omsecor.exe	102
PID 3272 wrote to memory of 3212	3272	omsecor.exe	102
PID 3272 wrote to memory of 3212	3272	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\b9813b8cdd59c9461f39f793bfb15090_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b9813b8cdd59c9461f39f793bfb15090_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 bb22604b76c7f436b1cc0bc5b9c74c4d2c78c08b69b3cb482fb68c8b9c215153
MD5 24f49a2edeb3b97743d23d2429e72838
SHA1 64c567b52499b19a21c76e3c7a72b181675a6523
SHA512 af1de16b34ae82a7ee3308e3cf75ff9ebf55ae64dd5960732c3b4db701217114eb504ee904f9b72f76f2bee3015a07b1ba92ee10221ba314cc6c05ac6fd56f10
SSDEEP 768:kMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:kbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 c8391a4aa8ac3b0cc5d33e5d4b582ca215e781420a636f2ad99748d87ce36f94
MD5 2b3023da1f61bf391c2dee89bc83e3e6
SHA1 677756ceab60c5427048b4de2fc331a8e4236b60
SHA512 f67a451196b326c3c6e4c6aeea4add22a5964a6bcac7184710d0d45dd90d6c7104567875f964309369203e54342f4ca18d8cde716caeabac1d1deb3e4df92f8b
SSDEEP 768:mMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:mbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 2c8f1efa0af974f457b8419f9d7d18dc2a2a6f8477d5f82d84ec587746051972
MD5 e4b3bacc19ce3819fd01a1622a5ae2cf
SHA1 a34f68416778bf17cf781accb99bebc5a14c25fd
SHA512 e544f3e2060f106c90bc16fb25252892bffed4a57a3582d9d255313ea0a9974cb80bfe9a88676677539bf01577e4e360ea0a9390c1f3602015b0b8db7034e15f
SSDEEP 768:FMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:FbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads