neconyd | 246853272f5acc357c940f93cdcde0f2479ef4e077f670bf2954954080a897b7

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe
Size 88KB
Sample240616-allgpavdpm
SHA256 246853272f5acc357c940f93cdcde0f2479ef4e077f670bf2954954080a897b7
MD5 c5f28de56cfaf6433d79dcd08dee33c0
SHA1 b2b9668d4f6e24d0841f076ae9e9e047fc48c0df
SHA512 3480ee63cf3f2fdae11e81993ad556f17be5b376e89bda4bcefa6416114f88ac0410a175ef9a48a6446bea15414edb146bc4a8eda9f3e3657a570501007bc672
SSDEEP 1536:Bd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:xdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1932	omsecor.exe
3132	omsecor.exe
5060	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 1932	932	c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe	89
PID 932 wrote to memory of 1932	932	c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe	89
PID 932 wrote to memory of 1932	932	c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe	89
PID 1932 wrote to memory of 3132	1932	omsecor.exe	97
PID 1932 wrote to memory of 3132	1932	omsecor.exe	97
PID 1932 wrote to memory of 3132	1932	omsecor.exe	97
PID 3132 wrote to memory of 5060	3132	omsecor.exe	98
PID 3132 wrote to memory of 5060	3132	omsecor.exe	98
PID 3132 wrote to memory of 5060	3132	omsecor.exe	98

C:\Users\Admin\AppData\Local\Temp\c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c5f28de56cfaf6433d79dcd08dee33c0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3132
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3044,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8
1⤵
PID:1324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 7752d2258466905bab25212fa1fa956686ba788ccb090a649562108214823245
MD5 1265093e47a4355598537e490efc60f5
SHA1 b18e3fbc0fd69e9d5c3f86d3a690ad51b17b5bd3
SHA512 c285669c012099f1015e4200dd874ab15ae35a34cc6b177466a9d38fc93803650929df3c08b692a14c14b17acdd06062b35b3ba1a3094624fb2382c2754122c1
SSDEEP 1536:xd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:BdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 c0b4e8f10d0bc70360a086061710b547e800339c4d8e6d4ab833f093631ca9e4
MD5 fe443b2af0fd0c3593f909b282184626
SHA1 db441de3f64fbfde46dccffe7e46518988bd0134
SHA512 f8f4da9770e6336c3c8dda6cb7cc3b3c481bed5d25ee63b78cda03a26c5329826ce852a63e19dba1aa73a9754f3db18aa48b5541c72aafc86981d9a686a1b3c8
SSDEEP 1536:Cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:ydseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 8e8c47b3e359c8aaccdd741fff9e61a4f8c8ee3b096f6c0d771ff8cc336806c9
MD5 4f5fdf34333ccb2627568d4cbeb8963c
SHA1 554290dd00786b739ec0a7391bb52d55219781f6
SHA512 1880774cc6290d879bc0673164b9d11e6db2095f35ae527c4c3fb3a89aad6c964d5134562edbe0c7701fa611abc2c91d9e4f85e2531d21416b099568dc0b6033
SSDEEP 1536:ld9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:NdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads