neconyd | 61509d758aa8fbd1518238b665518637ff289f34b3bbe6e33d1dde7d9a540336

Analysis

max time kernel
146s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 09:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
61509d758aa8fbd1518238b665518637ff289f34b3bbe6e33d1dde7d9a540336_NeikiAnalytics.exe
Size 134KB
Sample240624-lzganszdnj
SHA256 61509d758aa8fbd1518238b665518637ff289f34b3bbe6e33d1dde7d9a540336
MD5 34e512ae6cd61370109e170bcb8fe460
SHA1 5b209a83ffb74703a377e23644873489ad68f56e
SHA512 515ccb7c7841c90f428e9ad0922926a6953bc8a883374d1b3c3726a02fdc365d695b8287b0d7f3d39c39de4019d41309d9ce33ae3bc6bfcb6efd6e441079f1e9
SSDEEP 1536:eDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:AiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
4992	omsecor.exe
3392	omsecor.exe
4316	omsecor.exe
2332	omsecor.exe
3180	omsecor.exe
4332	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2712 set thread context of 3724	2712	61509d758aa8fbd1518238b665518637ff289f34b3bbe6e33d1dde7d9a540336_NeikiAnalytics.exe	82
PID 4992 set thread context of 3392	4992	omsecor.exe	86
PID 4316 set thread context of 2332	4316	omsecor.exe	98
PID 3180 set thread context of 4332	3180	omsecor.exe	102

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5068	2712	WerFault.exe	81
3936	4992	WerFault.exe	84
1660	4316	WerFault.exe	97
2980	3180	WerFault.exe	100

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 3724	2712	61509d758aa8fbd1518238b665518637ff289f34b3bbe6e33d1dde7d9a540336_NeikiAnalytics.exe	82
PID 2712 wrote to memory of 3724	2712	61509d758aa8fbd1518238b665518637ff289f34b3bbe6e33d1dde7d9a540336_NeikiAnalytics.exe	82
PID 2712 wrote to memory of 3724	2712	61509d758aa8fbd1518238b665518637ff289f34b3bbe6e33d1dde7d9a540336_NeikiAnalytics.exe	82
PID 2712 wrote to memory of 3724	2712	61509d758aa8fbd1518238b665518637ff289f34b3bbe6e33d1dde7d9a540336_NeikiAnalytics.exe	82
PID 2712 wrote to memory of 3724	2712	61509d758aa8fbd1518238b665518637ff289f34b3bbe6e33d1dde7d9a540336_NeikiAnalytics.exe	82
PID 3724 wrote to memory of 4992	3724	61509d758aa8fbd1518238b665518637ff289f34b3bbe6e33d1dde7d9a540336_NeikiAnalytics.exe	84
PID 3724 wrote to memory of 4992	3724	61509d758aa8fbd1518238b665518637ff289f34b3bbe6e33d1dde7d9a540336_NeikiAnalytics.exe	84
PID 3724 wrote to memory of 4992	3724	61509d758aa8fbd1518238b665518637ff289f34b3bbe6e33d1dde7d9a540336_NeikiAnalytics.exe	84
PID 4992 wrote to memory of 3392	4992	omsecor.exe	86
PID 4992 wrote to memory of 3392	4992	omsecor.exe	86
PID 4992 wrote to memory of 3392	4992	omsecor.exe	86
PID 4992 wrote to memory of 3392	4992	omsecor.exe	86
PID 4992 wrote to memory of 3392	4992	omsecor.exe	86
PID 3392 wrote to memory of 4316	3392	omsecor.exe	97
PID 3392 wrote to memory of 4316	3392	omsecor.exe	97
PID 3392 wrote to memory of 4316	3392	omsecor.exe	97
PID 4316 wrote to memory of 2332	4316	omsecor.exe	98
PID 4316 wrote to memory of 2332	4316	omsecor.exe	98
PID 4316 wrote to memory of 2332	4316	omsecor.exe	98
PID 4316 wrote to memory of 2332	4316	omsecor.exe	98
PID 4316 wrote to memory of 2332	4316	omsecor.exe	98
PID 2332 wrote to memory of 3180	2332	omsecor.exe	100
PID 2332 wrote to memory of 3180	2332	omsecor.exe	100
PID 2332 wrote to memory of 3180	2332	omsecor.exe	100
PID 3180 wrote to memory of 4332	3180	omsecor.exe	102
PID 3180 wrote to memory of 4332	3180	omsecor.exe	102
PID 3180 wrote to memory of 4332	3180	omsecor.exe	102
PID 3180 wrote to memory of 4332	3180	omsecor.exe	102
PID 3180 wrote to memory of 4332	3180	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\61509d758aa8fbd1518238b665518637ff289f34b3bbe6e33d1dde7d9a540336_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\61509d758aa8fbd1518238b665518637ff289f34b3bbe6e33d1dde7d9a540336_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\61509d758aa8fbd1518238b665518637ff289f34b3bbe6e33d1dde7d9a540336_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\61509d758aa8fbd1518238b665518637ff289f34b3bbe6e33d1dde7d9a540336_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3392
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4316
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 256
        8⤵
        Program crash
        
        PID:2980
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 292
        6⤵
        Program crash
        
        PID:1660
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 300
      4⤵
      Program crash
      PID:3936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 288
  2⤵
  - Program crash
  PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2712 -ip 2712
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4992 -ip 4992
1⤵
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4316 -ip 4316
1⤵
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3180 -ip 3180
1⤵
PID:3372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 285483ef2835ee4c57912e3b28119df71a76e6ac79cbb79d7e22a4ad755ee95a
MD5 588821ecda324ced82e9ddd188425101
SHA1 ac6f1c208d4330d4224107e498c47f753d060038
SHA512 7a313f209ee43ddf79e3f657839859b8d20463355f5528054045441d921842731ba344afef65e25a95eabcb8a620a02fe24bf71188e64a044b6f524bc0147202
SSDEEP 1536:wDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:miRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 071f6fcb3ab4f7e452b9986192c02c455f74b8a1848b58745e5b29e621d190ec
MD5 7627ab280e6f83015303950d07769045
SHA1 4f322393693dfa7041d975464bce7e765dca9805
SHA512 33ba7d7662b470e8b934aef6c5836ad72f6dba7e0fec471182d31bb3602eba5c1b58ccde9926d2523da363ea88b230dcbd2f21a7737e19546f2e88ebf7b0275c
SSDEEP 1536:CDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:0iRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 134KB
SHA256 c8a17deeeb27e308820dcdd607e460a45bbea0cad156e53ee2dfebcb9bb8d26c
MD5 72da24f8832d0e70253191ab970fae6c
SHA1 e2ecc4f9232233de2124156e3c4708a23d980f7a
SHA512 0de115166c0f9161f2e45b58e9e7008829561829ea98ba21620bbeea11b9576e1c518b8746126ab63503addf192c33c9938be5ecc98fe02c5a6fbf99d011ec3e
SSDEEP 1536:QDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:GiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2332-33-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2332-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2332-34-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2712-17-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2712-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3180-41-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3392-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3392-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3392-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3392-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3392-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3392-16-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3392-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3724-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3724-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3724-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3724-7-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4316-30-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4332-46-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4332-45-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4332-47-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4332-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4332-51-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4332-53-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4992-11-0x0000000000400000-0x0000000000424000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads