neconyd | 1285a2d8bcdde517b7b583ab4b895b0eb8e30740d654a2c4b3729164f7360e73

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 13:54

Target
9a6342dabe89cac1ddc647c5b3c41550_NeikiAnalytics.exe
Size 88KB
Sample240617-q7y8nstdra
SHA256 1285a2d8bcdde517b7b583ab4b895b0eb8e30740d654a2c4b3729164f7360e73
MD5 9a6342dabe89cac1ddc647c5b3c41550
SHA1 f991ae803d52f9d7b5e3a9e4bf085ba6ebe6aa4f
SHA512 1db2de2a2fe1da8ab677b5d3a14d394d618d3983ed96620c5e953a13688e5fdce003bd4bbe1685966a980dd756d0dc6185391f3bf6c4c29cd8ba69d822a5397e
SSDEEP 1536:6d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:adseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
3220	omsecor.exe
3976	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3220	4068	9a6342dabe89cac1ddc647c5b3c41550_NeikiAnalytics.exe	81
PID 4068 wrote to memory of 3220	4068	9a6342dabe89cac1ddc647c5b3c41550_NeikiAnalytics.exe	81
PID 4068 wrote to memory of 3220	4068	9a6342dabe89cac1ddc647c5b3c41550_NeikiAnalytics.exe	81
PID 3220 wrote to memory of 3976	3220	omsecor.exe	89
PID 3220 wrote to memory of 3976	3220	omsecor.exe	89
PID 3220 wrote to memory of 3976	3220	omsecor.exe	89

C:\Users\Admin\AppData\Local\Temp\9a6342dabe89cac1ddc647c5b3c41550_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9a6342dabe89cac1ddc647c5b3c41550_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3976

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 5aad333c8904a512e071e93513b686110bd32920851e03b51f0bd25cc1215126
MD5 0c2f241727d3a66b1e1e5fee21c4bc56
SHA1 e6d7fe7d27a88d0efe296a6670a4ace694e98c10
SHA512 bab215f310d336b39369e9330f886eb0487bec1d38e10e85103d434094de66bf6b1b50e96cdade1b3000cdc8ccf7d6238365100514c69b1c4e0a864f1d0ca202
SSDEEP 1536:Cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:ydseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 dcad8d850eb0f7def4ded45cdeeef7e97d217da4a9a2e3bfdcddc818f61503af
MD5 15a642006330ddbf762fe1b2e1a23d62
SHA1 04c79996791bff9af72955897c82d7a320636df3
SHA512 a0358a6dd04044e82f86552d691a4c7a5ecd135b70fa2f3ee4ffe1770398852b112e922a602257c4bb7f22c116dc064455edaa29b6aa0c2d1d643abbed1986ea
SSDEEP 1536:Id9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:4dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download