neconyd | 51e50920232529d1fc9d56ea6c7443389ca8e212113a8177a70d29aa5dcc4c7e

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 09:46

Target

51e50920232529d1fc9d56ea6c7443389ca8e212113a8177a70d29aa5dcc4c7e_NeikiAnalytics.exe
Size

84KB
MD5

771c31bdb1c3455741f90faac9b915c0
SHA1

5d0d5e370a34274692e2972691f3d13b64565e64
SHA256

51e50920232529d1fc9d56ea6c7443389ca8e212113a8177a70d29aa5dcc4c7e
SHA512

345fa71722e54c21e936065159d5807973595df10ceee757e83bd1eb0117846061f5ff95a3b275801c3f1076b7eb8bab60ddb4f1b6ef86e6043d185c6d093689
SSDEEP

768:AMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:AbIvYvZEyFKF6N4yS+AQmZTl/5

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Executes dropped EXE 3 IoCs

Processes:

omsecor.exeomsecor.exeomsecor.exe

pid process

1744 omsecor.exe
2748 omsecor.exe
2820 omsecor.exe

Loads dropped DLL 6 IoCs

Processes:

51e50920232529d1fc9d56ea6c7443389ca8e212113a8177a70d29aa5dcc4c7e_NeikiAnalytics.exeomsecor.exeomsecor.exe

pid	process
2228	51e50920232529d1fc9d56ea6c7443389ca8e212113a8177a70d29aa5dcc4c7e_NeikiAnalytics.exe
2228	51e50920232529d1fc9d56ea6c7443389ca8e212113a8177a70d29aa5dcc4c7e_NeikiAnalytics.exe
1744	omsecor.exe
1744	omsecor.exe
2748	omsecor.exe
2748	omsecor.exe

Drops file in System32 directory 1 IoCs

Processes:

omsecor.exe

description ioc process

File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe

description	ioc	process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

51e50920232529d1fc9d56ea6c7443389ca8e212113a8177a70d29aa5dcc4c7e_NeikiAnalytics.exeomsecor.exeomsecor.exe

description	pid	process	target process
PID 2228 wrote to memory of 1744	2228	51e50920232529d1fc9d56ea6c7443389ca8e212113a8177a70d29aa5dcc4c7e_NeikiAnalytics.exe	omsecor.exe
PID 2228 wrote to memory of 1744	2228	51e50920232529d1fc9d56ea6c7443389ca8e212113a8177a70d29aa5dcc4c7e_NeikiAnalytics.exe	omsecor.exe
PID 2228 wrote to memory of 1744	2228	51e50920232529d1fc9d56ea6c7443389ca8e212113a8177a70d29aa5dcc4c7e_NeikiAnalytics.exe	omsecor.exe
PID 2228 wrote to memory of 1744	2228	51e50920232529d1fc9d56ea6c7443389ca8e212113a8177a70d29aa5dcc4c7e_NeikiAnalytics.exe	omsecor.exe
PID 1744 wrote to memory of 2748	1744	omsecor.exe	omsecor.exe
PID 1744 wrote to memory of 2748	1744	omsecor.exe	omsecor.exe
PID 1744 wrote to memory of 2748	1744	omsecor.exe	omsecor.exe
PID 1744 wrote to memory of 2748	1744	omsecor.exe	omsecor.exe
PID 2748 wrote to memory of 2820	2748	omsecor.exe	omsecor.exe
PID 2748 wrote to memory of 2820	2748	omsecor.exe	omsecor.exe
PID 2748 wrote to memory of 2820	2748	omsecor.exe	omsecor.exe
PID 2748 wrote to memory of 2820	2748	omsecor.exe	omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
4⤵
- Executes dropped EXE
PID:2820

\Users\Admin\AppData\Roaming\omsecor.exe
Filesize
84KB

MD5
1e9f84c649efb109977ecae9dfb19a78

SHA1
a5ca5a49798fd881fc4cf9e49a4d59b47ed87727

SHA256
857b270a880d529eed40852942fd638cc58f55310b1f38a46b2336f473edddde

SHA512
3f7a03cfbf8adc8e2c30fd1b868e4f6f58de5e6fb933594db17037f6920973696e8663de7a008134c84bf49571edb1211fcef4731eeb8210705bf43358ca3bb1

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe
Filesize
84KB

MD5
7bd5b756d54c7f5372265b25c7ae96e4

SHA1
4da778c621019d3ea47e32cacdd8c66c549780cc

SHA256
8904457a7b6540bc5a175be17ea503a25aafe7054da8b87b38ce5acbd029dc9d

SHA512
7c2ca7b203765bf14166f8cebf43dace2b7c28eae4ad76a31e5f05fd2007f4535603d6c473e986efb03d7972f185ddbd933a6bca6f40d40761662ad68340e6f0

Download Submit
\Windows\SysWOW64\omsecor.exe
Filesize
84KB

MD5
e113dce288be998bb873bc32d42c68a0

SHA1
e30978c022fc11b20c3f1833f035747dac1fce3e

SHA256
3090b46b8dad183d6b2da72fcf505529c14b110ac09542e27b86ac8319bdc4e7

SHA512
fdde6c9e31a1cc59385860e008c6a120fd90690d00b74a72716fa95ed9238f9d9e4a84655aa4da4f7178c7a315f1c8ac28cda4f2e514dfc6e20affecc2936677

Download Submit