neconyd | 74c2afc0c08175400ed5eb53c52b2ffd57355695856e7e7fea12eb53d1a50eda

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8107d0083cb54b76cf1abdf65b8c7ab0_NeikiAnalytics.exe
Size 35KB
Sample240619-ecfx3atble
SHA256 74c2afc0c08175400ed5eb53c52b2ffd57355695856e7e7fea12eb53d1a50eda
MD5 8107d0083cb54b76cf1abdf65b8c7ab0
SHA1 69ed8918a10eb7ddeb1ffd77ca8b8c7ed2a7abf7
SHA512 158be92125de8fb4a488776fc6d781e50d64ba892fd89ee7891809e306ef997b0ae2c3db00386e8bb5633fcabd573e327fc65cf702a3f2d322ee9650d724e45d
SSDEEP 768:W6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:t8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2328	omsecor.exe
1980	omsecor.exe
1668	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2364	8107d0083cb54b76cf1abdf65b8c7ab0_NeikiAnalytics.exe
2364	8107d0083cb54b76cf1abdf65b8c7ab0_NeikiAnalytics.exe
2328	omsecor.exe
2328	omsecor.exe
1980	omsecor.exe
1980	omsecor.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2364-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2364-9-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x00090000000141e6-11.dat	upx
behavioral1/memory/2328-12-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2328-13-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2328-19-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2328-22-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x0007000000005a59-24.dat	upx
behavioral1/memory/2328-26-0x00000000002C0000-0x00000000002ED000-memory.dmp	upx
behavioral1/memory/2328-32-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1980-36-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x00090000000141e6-37.dat	upx
behavioral1/memory/1668-45-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1668-47-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1668-50-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2328	2364	8107d0083cb54b76cf1abdf65b8c7ab0_NeikiAnalytics.exe	28
PID 2364 wrote to memory of 2328	2364	8107d0083cb54b76cf1abdf65b8c7ab0_NeikiAnalytics.exe	28
PID 2364 wrote to memory of 2328	2364	8107d0083cb54b76cf1abdf65b8c7ab0_NeikiAnalytics.exe	28
PID 2364 wrote to memory of 2328	2364	8107d0083cb54b76cf1abdf65b8c7ab0_NeikiAnalytics.exe	28
PID 2328 wrote to memory of 1980	2328	omsecor.exe	32
PID 2328 wrote to memory of 1980	2328	omsecor.exe	32
PID 2328 wrote to memory of 1980	2328	omsecor.exe	32
PID 2328 wrote to memory of 1980	2328	omsecor.exe	32
PID 1980 wrote to memory of 1668	1980	omsecor.exe	33
PID 1980 wrote to memory of 1668	1980	omsecor.exe	33
PID 1980 wrote to memory of 1668	1980	omsecor.exe	33
PID 1980 wrote to memory of 1668	1980	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\8107d0083cb54b76cf1abdf65b8c7ab0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8107d0083cb54b76cf1abdf65b8c7ab0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 65d59029f666f7c566a4c704834a4b2a4989b10ecab4ad7619fd5af15c4b6804
MD5 a4e7d7588a7b6b8b8747638e0905a355
SHA1 5c97a282d8ce183e20ae464f0d72c45940b15021
SHA512 4d12e194b9706a4ba6911d33488a779351a38291dfc96c0833a5a785a974bc6045e378cd4b2395a577224f4503e39a681277f779d0074b65277ef98c70c19b43
SSDEEP 768:G6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:d8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 78d8251703f12eff1c6047a9a943f83116a57dafea3dbfad91841408e9669909
MD5 64b3e88147a747d24bf9b7344d92955c
SHA1 57a59ebd42e4a626dfbf3529a77593c7b20db4c8
SHA512 c36dc179178009bf7954eab50e9d23f1dd52995c3904a9b7d02868df2c45803917e7aa450b3525b12e939166869cff299a92a47943505157124482a43b989a0e
SSDEEP 768:56vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:U8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 35KB
SHA256 dce35c05a37b5278a10f188004035474730eda7b63f9a99025d1a5057cdb502e
MD5 52932fb7568fb722e217040e5e80b6d8
SHA1 f6f0f2d062912093fa2ba69cdc6e32bb364242d4
SHA512 272340ad192e2e572ca83570ab6096badf40b4633dc58535b54f83d4dd2bdb92631bd6bc76d399f76857b54e142f8705e1a8e764e1efdc8cf695b644a779c9e8
SSDEEP 768:J6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:k8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1668-50-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1668-47-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1668-45-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1980-36-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2328-22-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2328-26-0x00000000002C0000-0x00000000002ED000-memory.dmp

Download

memory/2328-32-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2328-19-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2328-13-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2328-12-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2364-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2364-9-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads