neconyd | f41d72e0c8cacd3a64e389bbae5dbb4cad8f22bc959c0c3e31ce836b8d452046

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
399e9f706b569183e965401e81df1540_NeikiAnalytics.exe
Size 88KB
Sample240617-c99was1blb
SHA256 f41d72e0c8cacd3a64e389bbae5dbb4cad8f22bc959c0c3e31ce836b8d452046
MD5 399e9f706b569183e965401e81df1540
SHA1 dca729935d708821f9861ef27a43b68dcde3aab2
SHA512 804ebf0216725cde455f4ac69d79573c902743d50c6348c265f4ec138470e00e6ea9025883d770af23e9130f654f43458b17f46cd940f14963682926f7bcde7b
SSDEEP 1536:9d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:1dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
3292	omsecor.exe
4796	omsecor.exe
1632	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 3292	3936	399e9f706b569183e965401e81df1540_NeikiAnalytics.exe	82
PID 3936 wrote to memory of 3292	3936	399e9f706b569183e965401e81df1540_NeikiAnalytics.exe	82
PID 3936 wrote to memory of 3292	3936	399e9f706b569183e965401e81df1540_NeikiAnalytics.exe	82
PID 3292 wrote to memory of 4796	3292	omsecor.exe	90
PID 3292 wrote to memory of 4796	3292	omsecor.exe	90
PID 3292 wrote to memory of 4796	3292	omsecor.exe	90
PID 4796 wrote to memory of 1632	4796	omsecor.exe	91
PID 4796 wrote to memory of 1632	4796	omsecor.exe	91
PID 4796 wrote to memory of 1632	4796	omsecor.exe	91

C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\399e9f706b569183e965401e81df1540_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 bfd5881c9c8b85a46cf8c76a138e7f1b8022157b053e6f2bb84134628bf0eef8
MD5 cd0f9616a781a75fe18bea70bfe97cb8
SHA1 b084fae9667842ccdc17b55d52bc528df279febf
SHA512 2715d74e361899dda8bf7dc4f2212755d6b4f6bf1bab457d8d01a1d336b76cc98e523b1878d3398f3502ea101ca2cf6f710761362b1b07c486ee7221d5e193bf
SSDEEP 1536:Jd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:JdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 60c51aa145216915c2a73950c100b8c4b6d2cbec599b4dfab039478f7f7f9178
MD5 68d9637a731406ed1c0123f8380f1c45
SHA1 43eb54b5006e488a67a350b1f7940081ac462802
SHA512 5bb422eb9347838595022ae7f6d361cc4ea284831b8efa09920d5256d78eee1094cd8a62de38ccb2d90f50d017489e75f9e7cec7a4e244a34b90e803640107b4
SSDEEP 1536:Ud9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:sdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 d55fc511b03e99e6a82fc1df90b19a1e12723683fc27097143516c35545a7771
MD5 868ba48daa09e76f18f3121ca6c7774b
SHA1 1734f14cae70a31dd767e2e1820dc28e2c5620b0
SHA512 0bc6da64ca4eaf1fe2cff055064d362dba24ba8f53772a7ad6a0e39615ca9f78a7405427cd6f17066a0644ede07f3f99bbb99b8709903910894f53b54ee72a28
SSDEEP 1536:Id9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:4dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads