neconyd | b9c09f344bc75218ed086b11a1419c1804387cbc92a29eb9ac5cf4fadeac2883

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c9d0702f6d06b33f5f6f78cdd725b3a0_NeikiAnalytics.exe
Size 76KB
Sample240616-bvpq5stejb
SHA256 b9c09f344bc75218ed086b11a1419c1804387cbc92a29eb9ac5cf4fadeac2883
MD5 c9d0702f6d06b33f5f6f78cdd725b3a0
SHA1 a7ac3c7150cc2a26fe1d836f9f94f94761f1afd7
SHA512 238669508dc0a8955cab6e37a0d680ade2be39264eddaa566f384fcc6421bf3bb8e4d3d7dd8d46878a01b0139e4580014ef68895cf2943ed4ebf9d823815b37d
SSDEEP 1536:ld9dseIOcE93dIvYvZEyF4EEOF6N4yS+AQmZTl/5011:NdseIOKEZEyFjEOFqTiQm5l/5011
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4564	omsecor.exe
3284	omsecor.exe
1708	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 4564	4524	c9d0702f6d06b33f5f6f78cdd725b3a0_NeikiAnalytics.exe	82
PID 4524 wrote to memory of 4564	4524	c9d0702f6d06b33f5f6f78cdd725b3a0_NeikiAnalytics.exe	82
PID 4524 wrote to memory of 4564	4524	c9d0702f6d06b33f5f6f78cdd725b3a0_NeikiAnalytics.exe	82
PID 4564 wrote to memory of 3284	4564	omsecor.exe	89
PID 4564 wrote to memory of 3284	4564	omsecor.exe	89
PID 4564 wrote to memory of 3284	4564	omsecor.exe	89
PID 3284 wrote to memory of 1708	3284	omsecor.exe	90
PID 3284 wrote to memory of 1708	3284	omsecor.exe	90
PID 3284 wrote to memory of 1708	3284	omsecor.exe	90

C:\Users\Admin\AppData\Local\Temp\c9d0702f6d06b33f5f6f78cdd725b3a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c9d0702f6d06b33f5f6f78cdd725b3a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 f6228158c7a101abaf6c747a8d721d76e69dc802d1af12f435f4da889b9234f8
MD5 ffdd526ed6ecb89c157acfb1c93e5d52
SHA1 e732a5b5a3fdd46c9f2950da2ab630947086f1f8
SHA512 c304d1f550ec0426e399b9b0236204d25a432d06550d9d936f7d68ba45e1f65524b2703babb70939c92fd4657a27da5073b7736ddc0033637746d4605ce72432
SSDEEP 1536:7d9dseIOcE93dIvYvZEyF4EEOF6N4yS+AQmZTl/5011:LdseIOKEZEyFjEOFqTiQm5l/5011
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 eaa6986a51497602bcd161d85044e07145ccb2e7140aa95922b8d04522b55593
MD5 a8dff132886c0b25901c880b92d01484
SHA1 806cd41d865239835590a23033ba3b2b898b6aae
SHA512 2a282c7c6f5d6d50ea43bb18a843c42c72c9d9a708aee7c152b2df91df9c9d06860c263091a8564edee26199dac883b0812f169f713176b8f248094561e3567c
SSDEEP 1536:pd9dseIOcE93dIvYvZEyF4EEOF6N4yS+AQmZTl/5011:pdseIOKEZEyFjEOFqTiQm5l/5011
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 af1496e6b4e535924b10d4b93ed71e2f83d8d9e0e15dc762d3290fae6057355e
MD5 37222a9cd1a29427e9d9f46278f034dc
SHA1 78e4a8923210ca54d7cacac42f46fd05020c90c5
SHA512 a3a8940d93b9afba37646b6fe204d190fece05f5c66430b303448c2c81fd203c3a3c349638d0757436df0aa65633d675af4278790ac084f0dadf8213568b3838
SSDEEP 1536:zd9dseIOcE93dIvYvZEyF4EEOF6N4yS+AQmZTl/5011:zdseIOKEZEyFjEOFqTiQm5l/5011
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1708-19-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1708-20-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3284-12-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3284-17-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4524-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4524-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4564-6-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4564-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4564-11-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads