neconyd | 0dcdb75000f1eab9427acc03174b690461ef704fbeade202ebeb20a2463c0478

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-06-2024 21:11

Target

0dcdb75000f1eab9427acc03174b690461ef704fbeade202ebeb20a2463c0478_NeikiAnalytics.exe
Size

72KB
MD5

f5b2b01b74f7b96cab664486eb6787b0
SHA1

d75be187f4208735c82be06efb852c5fabfbac0a
SHA256

0dcdb75000f1eab9427acc03174b690461ef704fbeade202ebeb20a2463c0478
SHA512

f1165f79a17b4ea278d13fa32d393ba0a2a2185f9b3bbc2cf0012cf8048fa8aec76a1a091681c816a221a6e6e1098c259dcb1a008c04e31d57674d280f07aa47
SSDEEP

1536:7d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:LdseIOMEZEyFjEOFqTiQm5l/5211

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Executes dropped EXE 3 IoCs

Processes:

omsecor.exeomsecor.exeomsecor.exe

pid process

2372 omsecor.exe
1664 omsecor.exe
2192 omsecor.exe

Loads dropped DLL 6 IoCs

Processes:

0dcdb75000f1eab9427acc03174b690461ef704fbeade202ebeb20a2463c0478_NeikiAnalytics.exeomsecor.exeomsecor.exe

pid	process
2972	0dcdb75000f1eab9427acc03174b690461ef704fbeade202ebeb20a2463c0478_NeikiAnalytics.exe
2972	0dcdb75000f1eab9427acc03174b690461ef704fbeade202ebeb20a2463c0478_NeikiAnalytics.exe
2372	omsecor.exe
2372	omsecor.exe
1664	omsecor.exe
1664	omsecor.exe

Drops file in System32 directory 1 IoCs

Processes:

omsecor.exe

description ioc process

File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe

description	ioc	process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0dcdb75000f1eab9427acc03174b690461ef704fbeade202ebeb20a2463c0478_NeikiAnalytics.exeomsecor.exeomsecor.exe

description	pid	process	target process
PID 2972 wrote to memory of 2372	2972	0dcdb75000f1eab9427acc03174b690461ef704fbeade202ebeb20a2463c0478_NeikiAnalytics.exe	omsecor.exe
PID 2972 wrote to memory of 2372	2972	0dcdb75000f1eab9427acc03174b690461ef704fbeade202ebeb20a2463c0478_NeikiAnalytics.exe	omsecor.exe
PID 2972 wrote to memory of 2372	2972	0dcdb75000f1eab9427acc03174b690461ef704fbeade202ebeb20a2463c0478_NeikiAnalytics.exe	omsecor.exe
PID 2972 wrote to memory of 2372	2972	0dcdb75000f1eab9427acc03174b690461ef704fbeade202ebeb20a2463c0478_NeikiAnalytics.exe	omsecor.exe
PID 2372 wrote to memory of 1664	2372	omsecor.exe	omsecor.exe
PID 2372 wrote to memory of 1664	2372	omsecor.exe	omsecor.exe
PID 2372 wrote to memory of 1664	2372	omsecor.exe	omsecor.exe
PID 2372 wrote to memory of 1664	2372	omsecor.exe	omsecor.exe
PID 1664 wrote to memory of 2192	1664	omsecor.exe	omsecor.exe
PID 1664 wrote to memory of 2192	1664	omsecor.exe	omsecor.exe
PID 1664 wrote to memory of 2192	1664	omsecor.exe	omsecor.exe
PID 1664 wrote to memory of 2192	1664	omsecor.exe	omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
4⤵
- Executes dropped EXE
PID:2192

\Users\Admin\AppData\Roaming\omsecor.exe
Filesize
72KB

MD5
3a95f40cbb305270beb37912633b5068

SHA1
5945fd6612316171bd825bc6011526bc00ae065c

SHA256
70b2b1f1baa39634ac3e63175ed960eed3edcc52751297bdde3d16e02f0f0241

SHA512
35eb1b80648f99cb355250101cde20551ab9b16a27f20fd1182ae6418f5dc70f7f65227b423198b27c684fbf88a2d2b53782a733e6bd83cc7c5f399e10b1183d

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe
Filesize
72KB

MD5
1f579cb6ec246797d619357918d94dc1

SHA1
8909f572b331c016e48d710a13cbfa6c03c84730

SHA256
aaf2007d1380e171c531273580a7b861d572ed6d7d9fc8de2b4ee2ba3c3c485d

SHA512
c6db89141435304bd5190332169f16bfa8663daabd4b924f1fad54d63565cf1195cc93e22ba136dd596600d51a9efad835c5064ddbaf5d540826409748526e82

Download Submit
\Windows\SysWOW64\omsecor.exe
Filesize
72KB

MD5
e1be5add0a423daf2367e0506aa2e8f1

SHA1
ffa7852a3c5cc333825537f63e5757c307bb0bf7

SHA256
9c84e215420d235b01253d0ac84cac77fd4c8ae9c5f6d6173ddccb1833cd589f

SHA512
f13621b8db193ab4095060efda56411598e5b91ac2b0076957eabadd71eb814936e43914d52966d6fce42951fc467b20438b5bd273cbf3de70f17d59526e158a

Download Submit