neconyd | 12e0092281dda4d44ba8b751dd3c3c6eab36df6e30100718970df90ea0a9b674

Analysis

max time kernel
142s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
12e0092281dda4d44ba8b751dd3c3c6eab36df6e30100718970df90ea0a9b674_NeikiAnalytics.exe
Size 80KB
Sample240625-1emdhsxcmn
SHA256 12e0092281dda4d44ba8b751dd3c3c6eab36df6e30100718970df90ea0a9b674
MD5 c983afa742292e030eb88e4e2d3ecc80
SHA1 90403613a3d025281e39058bf3180ed5792bb893
SHA512 c82da29d85328098c9f0fa76bae6b4ec83fafc1c17029fccf0a33a29e0ae45f2bf4c8b783a7c8cef49ce552c0369e1dc2ddecf2c70c63a357389f933798b2935
SSDEEP 768:hfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:hfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4084	omsecor.exe
3212	omsecor.exe
3516	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4084	4804	12e0092281dda4d44ba8b751dd3c3c6eab36df6e30100718970df90ea0a9b674_NeikiAnalytics.exe	81
PID 4804 wrote to memory of 4084	4804	12e0092281dda4d44ba8b751dd3c3c6eab36df6e30100718970df90ea0a9b674_NeikiAnalytics.exe	81
PID 4804 wrote to memory of 4084	4804	12e0092281dda4d44ba8b751dd3c3c6eab36df6e30100718970df90ea0a9b674_NeikiAnalytics.exe	81
PID 4084 wrote to memory of 3212	4084	omsecor.exe	89
PID 4084 wrote to memory of 3212	4084	omsecor.exe	89
PID 4084 wrote to memory of 3212	4084	omsecor.exe	89
PID 3212 wrote to memory of 3516	3212	omsecor.exe	90
PID 3212 wrote to memory of 3516	3212	omsecor.exe	90
PID 3212 wrote to memory of 3516	3212	omsecor.exe	90

C:\Users\Admin\AppData\Local\Temp\12e0092281dda4d44ba8b751dd3c3c6eab36df6e30100718970df90ea0a9b674_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\12e0092281dda4d44ba8b751dd3c3c6eab36df6e30100718970df90ea0a9b674_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 80KB
SHA256 1cae4611cfc909fd213b902c52be3696efd82b0cb46a00f62d63dc4277d1b04e
MD5 ae608cb5cc9811b9c2599609b690f14b
SHA1 99c127c4873663dba9d2a2e02bc7e9bb557e5886
SHA512 8176680e8f42e3c2f086c57c81da43d155abd9f042a68e965cf33ccdfc2aba11c5d9d58682b7ac4e78109e3220520437f9835d1f067c005f660e0f06fda806ea
SSDEEP 768:WfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:WfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 80KB
SHA256 9597773a6634133454920291b96fb461bee793c79074a5a55c35874a70b874a3
MD5 068e41ce4cae090e7c4ed4fb2e565fcd
SHA1 1ff006594e18f31bf4d3b8fd7931812427c3969f
SHA512 360124e9097e2112000034027038a4821f66ba9851bc4b9aba712a773a6806e8d2d6e61e2a0d19916668f1bb1cbb1817f8808358965d638773463ef57016bab1
SSDEEP 768:RfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:RfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 80KB
SHA256 bce4ad0a2435e9830c81fb1826ea5f6718ebb9e307206665d8c39dbff0fe4b8e
MD5 92dacab759ae20a73d429d442b61c50b
SHA1 bae3494a1d5be16eac2cf6245804306b22bb0f91
SHA512 2442110b54db899bb0a30c2bdd80053f92b98ad965f4de1fb9091f892dc7793adb26c8c8314e3e9ce6a5b25f1c6bbe37cbb35ee7b63a089e354543f063b9b0d7
SSDEEP 768:yfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:yfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads