neconyd | 0e4f0c30804fe0165e9b746a644581511d403f24c725e4ac318b95a05d8e6183

Analysis

max time kernel
142s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2024, 21:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0e4f0c30804fe0165e9b746a644581511d403f24c725e4ac318b95a05d8e6183_NeikiAnalytics.exe
Size 76KB
Sample240622-z4qa2avbla
SHA256 0e4f0c30804fe0165e9b746a644581511d403f24c725e4ac318b95a05d8e6183
MD5 4a41b0c0efc3def4173760be72a8e1a0
SHA1 77d20d46208db95f64aa58d5a9e137d6f09480cc
SHA512 24634f45bc5c94613f5f44f8bbec9b8199fe81d2e488f83f4cf4074a2a28a383486c02891dfb1f77d9c02ae9eefde375138d00252668ef11d1038cae6300d6f5
SSDEEP 768:MMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:MbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4900	omsecor.exe
712	omsecor.exe
1484	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 4900	3800	0e4f0c30804fe0165e9b746a644581511d403f24c725e4ac318b95a05d8e6183_NeikiAnalytics.exe	81
PID 3800 wrote to memory of 4900	3800	0e4f0c30804fe0165e9b746a644581511d403f24c725e4ac318b95a05d8e6183_NeikiAnalytics.exe	81
PID 3800 wrote to memory of 4900	3800	0e4f0c30804fe0165e9b746a644581511d403f24c725e4ac318b95a05d8e6183_NeikiAnalytics.exe	81
PID 4900 wrote to memory of 712	4900	omsecor.exe	89
PID 4900 wrote to memory of 712	4900	omsecor.exe	89
PID 4900 wrote to memory of 712	4900	omsecor.exe	89
PID 712 wrote to memory of 1484	712	omsecor.exe	90
PID 712 wrote to memory of 1484	712	omsecor.exe	90
PID 712 wrote to memory of 1484	712	omsecor.exe	90

C:\Users\Admin\AppData\Local\Temp\0e4f0c30804fe0165e9b746a644581511d403f24c725e4ac318b95a05d8e6183_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0e4f0c30804fe0165e9b746a644581511d403f24c725e4ac318b95a05d8e6183_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:712
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 8e0887a4dd13cea8ac441f7bb4ba7e8fa60c20cdfd77116cabda6703b6468950
MD5 f7adb74285286b8e3cb75a92c3fb2355
SHA1 6c0aa340c27b612ae3e8ed874017216175b6713c
SHA512 04acfcbf8798937a4b0adb64ff2951865a6f88bc596d0e5aa629823030a0c4f933b03725e0394ec66d1869599f5b7c0c2c686a3a57468577dc0225492a9472b5
SSDEEP 768:AMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:AbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 836748abdd43bbc0fcb4e53189e448f854f8e173042881223d07a26c6f9f6012
MD5 20cec8d9a8c0d9566581a6049555e88c
SHA1 b21ddbd78f19446a45602cba5e8da473ddfeec52
SHA512 54f6b888827b812c807eb4e049f468ed28c6aede15432669dbaabbc22b6df3573c7fbcd9106b19d85acfcbc28b8da440067d518d2a2da1ea2ce484471273b703
SSDEEP 768:oMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:obIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 026597c6485517259b97a0c2202431b8341cb0458fbf0760ad844dae1b0b0e56
MD5 17e4861e9d60bd8ef386c8e8e55623fc
SHA1 7ae0cdbbb3a225601c4397c6194c552b2ca05fbc
SHA512 f7704b6fbc6fdce9f79a5df8f67c813dc4e198d4449aaa170bb62b836f15758865ba429c1d48c3d365a7e2154918e21481695b1c6a04dc05141c3ee99bb37f4c
SSDEEP 768:LMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:LbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads