neconyd | 5e022ad97643f02dca1260e34e98ecc31736bcef7f9f0691e9138887292f9c9f

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
Size 134KB
Sample240619-gph93avgmf
SHA256 5e022ad97643f02dca1260e34e98ecc31736bcef7f9f0691e9138887292f9c9f
MD5 959c9e32ffafbe2b02a33708f3032780
SHA1 9fb2ba57683f6a8a4681e0d346468772b3b499f7
SHA512 d75d7479d7f5a883648ef5a92fb7dadbba87fcbfa2ce22aba0371b5f5587e7e4925ea1bc4dd5c0a6aaf8a8c5e9399ad7f62288811f0dce3b52c18f7f7a2ce305
SSDEEP 1536:sDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:SiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
2540	omsecor.exe
2736	omsecor.exe
2240	omsecor.exe
5092	omsecor.exe
5036	omsecor.exe
3176	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2644 set thread context of 4660	2644	959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe	90
PID 2540 set thread context of 2736	2540	omsecor.exe	94
PID 2240 set thread context of 5092	2240	omsecor.exe	115
PID 5036 set thread context of 3176	5036	omsecor.exe	118

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3592	2540	WerFault.exe	92
3872	2644	WerFault.exe	89
3048	2240	WerFault.exe	114
4684	5036	WerFault.exe	117

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 4660	2644	959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe	90
PID 2644 wrote to memory of 4660	2644	959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe	90
PID 2644 wrote to memory of 4660	2644	959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe	90
PID 2644 wrote to memory of 4660	2644	959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe	90
PID 2644 wrote to memory of 4660	2644	959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe	90
PID 4660 wrote to memory of 2540	4660	959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe	92
PID 4660 wrote to memory of 2540	4660	959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe	92
PID 4660 wrote to memory of 2540	4660	959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe	92
PID 2540 wrote to memory of 2736	2540	omsecor.exe	94
PID 2540 wrote to memory of 2736	2540	omsecor.exe	94
PID 2540 wrote to memory of 2736	2540	omsecor.exe	94
PID 2540 wrote to memory of 2736	2540	omsecor.exe	94
PID 2540 wrote to memory of 2736	2540	omsecor.exe	94
PID 2736 wrote to memory of 2240	2736	omsecor.exe	114
PID 2736 wrote to memory of 2240	2736	omsecor.exe	114
PID 2736 wrote to memory of 2240	2736	omsecor.exe	114
PID 2240 wrote to memory of 5092	2240	omsecor.exe	115
PID 2240 wrote to memory of 5092	2240	omsecor.exe	115
PID 2240 wrote to memory of 5092	2240	omsecor.exe	115
PID 2240 wrote to memory of 5092	2240	omsecor.exe	115
PID 2240 wrote to memory of 5092	2240	omsecor.exe	115
PID 5092 wrote to memory of 5036	5092	omsecor.exe	117
PID 5092 wrote to memory of 5036	5092	omsecor.exe	117
PID 5092 wrote to memory of 5036	5092	omsecor.exe	117
PID 5036 wrote to memory of 3176	5036	omsecor.exe	118
PID 5036 wrote to memory of 3176	5036	omsecor.exe	118
PID 5036 wrote to memory of 3176	5036	omsecor.exe	118
PID 5036 wrote to memory of 3176	5036	omsecor.exe	118
PID 5036 wrote to memory of 3176	5036	omsecor.exe	118

C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\959c9e32ffafbe2b02a33708f3032780_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2240
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:3176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 256
        8⤵
        Program crash
        
        PID:4684
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 292
        6⤵
        Program crash
        
        PID:3048
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 288
      4⤵
      Program crash
      PID:3592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 300
  2⤵
  - Program crash
  PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2644 -ip 2644
1⤵
PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2540 -ip 2540
1⤵
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:8
1⤵
PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2240 -ip 2240
1⤵
PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5036 -ip 5036
1⤵
PID:3992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 0e19db6461cd993cc33617ce683a6ce42b1715751104fb35e825659c3cfd6450
MD5 0d1ec6c91c9c3426f73d815bb047f236
SHA1 9d0828c9a03d948b490f7e17cc8d46bbf7006287
SHA512 1ee85647bbb98af6823763d495f563c729e8a1037c9fd1a92c7c20d64794f95184e5d0024c664f575370f9d0df58d962bea69f85b741ed42356d0d88d6971233
SSDEEP 1536:tDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:9iRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 5a5cfad106754880c9c9f54a182c89e6cb273182c39731dbcf3472839ac09485
MD5 4a7c221f067c723f7e38e9828be3fc04
SHA1 7cb4cd8b2c7ba16431b459ecc8700acf988841a2
SHA512 cb6f24139bd336d8d9cc07c7ac8e5b21d095928b92e84fd9fd35c4e35c4838bfbea0a4a680c7da9695b2320a67b7b1fd3835319a29a97c43c63ec286bd8eb9af
SSDEEP 1536:EDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:aiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 134KB
SHA256 eae58ad2727bbfc7a9d75aed641699ec60b791643cd51831639fb97119d389f6
MD5 a560f7069933b6012489976c365297e0
SHA1 ce4153b75f4a7e96d31bd3a7dbdd1d084ca54810
SHA512 c3a46938dcbbb175c149827ac4b54a147cbbe49328125703474b4008cd124f53a32d7aa1f93d31d329d2557c020aa5baf81bd21ae29b3afa233876ac166c250a
SSDEEP 1536:dDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:tiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2240-31-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2540-11-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2644-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2736-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2736-30-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2736-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2736-16-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2736-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2736-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2736-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3176-46-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3176-47-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3176-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3176-51-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4660-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4660-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4660-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4660-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5036-42-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5092-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5092-35-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5092-34-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads