neconyd | eed1278f56dbd46ebb9aba4e5443972d62b63d9bc6e90a5cbd1bda7be0c45593

Analysis

max time kernel
142s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2cebb2677c2499426ed67ac20b291950_NeikiAnalytics.exe
Size 76KB
Sample240617-brcmeaxfre
SHA256 eed1278f56dbd46ebb9aba4e5443972d62b63d9bc6e90a5cbd1bda7be0c45593
MD5 2cebb2677c2499426ed67ac20b291950
SHA1 241776b7c928ee58a74a90d1a55e98e64943c79f
SHA512 cbd7a459ca13ce4703837514e14fbd1eb661f264315404ef329a31bdb8a6dce9e798abeb45d3290d619d32d31df39345264ac79dd2b4df24af951cd06fb4a8a8
SSDEEP 1536:Zd9dseIOcE93dIvYvZDyF4EEOF6N4yS+AQmZTl/5R11:5dseIOKEZDyFjEOFqTiQm5l/5R11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
3780	omsecor.exe
4328	omsecor.exe
2592	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 3780	1664	2cebb2677c2499426ed67ac20b291950_NeikiAnalytics.exe	82
PID 1664 wrote to memory of 3780	1664	2cebb2677c2499426ed67ac20b291950_NeikiAnalytics.exe	82
PID 1664 wrote to memory of 3780	1664	2cebb2677c2499426ed67ac20b291950_NeikiAnalytics.exe	82
PID 3780 wrote to memory of 4328	3780	omsecor.exe	94
PID 3780 wrote to memory of 4328	3780	omsecor.exe	94
PID 3780 wrote to memory of 4328	3780	omsecor.exe	94
PID 4328 wrote to memory of 2592	4328	omsecor.exe	95
PID 4328 wrote to memory of 2592	4328	omsecor.exe	95
PID 4328 wrote to memory of 2592	4328	omsecor.exe	95

C:\Users\Admin\AppData\Local\Temp\2cebb2677c2499426ed67ac20b291950_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2cebb2677c2499426ed67ac20b291950_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 a5853ef0301342f5261a51ebec01354f0e20775de758888da8178ed34ad79a1e
MD5 e3eb669804d33366da278c6ec816f93d
SHA1 5c0cd05b867f85e42050ead7520013cfdadcf9b4
SHA512 888c64e40fd930f05b21305237b98e467433f0ae8881ac8b00894bbd4b6e42ebb58d85ed6ce78fcd2f172a0633508d7de0d063b86b1781ee5f72bd314a27c269
SSDEEP 1536:Fd9dseIOcE93dIvYvZDyF4EEOF6N4yS+AQmZTl/5R11:tdseIOKEZDyFjEOFqTiQm5l/5R11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 7fc8de45f8cd59acfbea02e2f0093dd3dbc313b6a5a4d0cf7f8525388c82791d
MD5 a893173b10e6ebc367c1f379fb7d0009
SHA1 46fac9659bcfd64820e7c6900afdbc1da6f9800f
SHA512 ceb18cb18b9a7da717d1fe3f637c9e2265fc0609c6fd2a515f2141fcd6a512f8fb03fa097050110aaff808ab930eeb8e0c6353ad87221b9dd4a80aff17d24739
SSDEEP 1536:Vd9dseIOcE93dIvYvZDyF4EEOF6N4yS+AQmZTl/5R11:ddseIOKEZDyFjEOFqTiQm5l/5R11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 200c380a71953a5c1d16633a097ac46e72d3a8fd166e174ba5a841ca18390e3b
MD5 caf3cc837b0fe8b122ed4b78dbd2148b
SHA1 a2b2053cda32fddde4176cfd524bc41cc3834d57
SHA512 abfc62e89e83cdd1393fae6d68b1a1f5d2ed23dd4164d60c69dd1d3d434e09fb46cbfcaadfbace5d3375a308559574c298f57633d4a17668b6c6b7505e215970
SSDEEP 1536:Bd9dseIOcE93dIvYvZDyF4EEOF6N4yS+AQmZTl/5R11:xdseIOKEZDyFjEOFqTiQm5l/5R11
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1664-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1664-4-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2592-18-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2592-20-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3780-6-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3780-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3780-11-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4328-13-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4328-17-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads