neconyd | f41d72e0c8cacd3a64e389bbae5dbb4cad8f22bc959c0c3e31ce836b8d452046

Analysis

max time kernel
145s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
399e9f706b569183e965401e81df1540_NeikiAnalytics.exe
Size 88KB
Sample240617-c99was1blb
SHA256 f41d72e0c8cacd3a64e389bbae5dbb4cad8f22bc959c0c3e31ce836b8d452046
MD5 399e9f706b569183e965401e81df1540
SHA1 dca729935d708821f9861ef27a43b68dcde3aab2
SHA512 804ebf0216725cde455f4ac69d79573c902743d50c6348c265f4ec138470e00e6ea9025883d770af23e9130f654f43458b17f46cd940f14963682926f7bcde7b
SSDEEP 1536:9d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:1dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2176	omsecor.exe
2700	omsecor.exe
1876	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1720	399e9f706b569183e965401e81df1540_NeikiAnalytics.exe
1720	399e9f706b569183e965401e81df1540_NeikiAnalytics.exe
2176	omsecor.exe
2176	omsecor.exe
2700	omsecor.exe
2700	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2176	1720	399e9f706b569183e965401e81df1540_NeikiAnalytics.exe	28
PID 1720 wrote to memory of 2176	1720	399e9f706b569183e965401e81df1540_NeikiAnalytics.exe	28
PID 1720 wrote to memory of 2176	1720	399e9f706b569183e965401e81df1540_NeikiAnalytics.exe	28
PID 1720 wrote to memory of 2176	1720	399e9f706b569183e965401e81df1540_NeikiAnalytics.exe	28
PID 2176 wrote to memory of 2700	2176	omsecor.exe	32
PID 2176 wrote to memory of 2700	2176	omsecor.exe	32
PID 2176 wrote to memory of 2700	2176	omsecor.exe	32
PID 2176 wrote to memory of 2700	2176	omsecor.exe	32
PID 2700 wrote to memory of 1876	2700	omsecor.exe	33
PID 2700 wrote to memory of 1876	2700	omsecor.exe	33
PID 2700 wrote to memory of 1876	2700	omsecor.exe	33
PID 2700 wrote to memory of 1876	2700	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 bfd5881c9c8b85a46cf8c76a138e7f1b8022157b053e6f2bb84134628bf0eef8
MD5 cd0f9616a781a75fe18bea70bfe97cb8
SHA1 b084fae9667842ccdc17b55d52bc528df279febf
SHA512 2715d74e361899dda8bf7dc4f2212755d6b4f6bf1bab457d8d01a1d336b76cc98e523b1878d3398f3502ea101ca2cf6f710761362b1b07c486ee7221d5e193bf
SSDEEP 1536:Jd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:JdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 516ceb97a4dbfc586d4f80219619dd350d09166688ccf1cf446da749937bebbf
MD5 ca57e62b4d968efdf63f4f97b18ee7e7
SHA1 058c3268e8328ac57b2c129b4b3470940957f671
SHA512 ffd05c05d749298faae084db2f85345a54b14949fc500ce8617c7393d68b1fdb9ac1076777652333fde55432198f33c1507b59470d54beac18194a4c0374b485
SSDEEP 1536:2d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:OdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 e79cb85695b13808144bbf0072844773e883aa0ba8e497da38eb09697473c3db
MD5 9b98e0ce19304a5106ddac0b5dff4b1a
SHA1 8e85e3e443ed86addbc0328cc1fb9b00a684cb01
SHA512 0d66ec0228cd92b264857f8cbd88467e7c5e54b8b0e3ad51c4dc2a46188b710657a11cdeb0a537b861e3d43d6847e324608ed20fab5d23f49304f48a763c77b6
SSDEEP 1536:nd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:PdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads