neconyd | 06a546b4b27844cddea97bde95a8a2dd3d591b087cee3c505b353378ea88c208

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06a546b4b27844cddea97bde95a8a2dd3d591b087cee3c505b353378ea88c208_NeikiAnalytics.exe
Size 35KB
Sample240628-tw2ffawfpf
SHA256 06a546b4b27844cddea97bde95a8a2dd3d591b087cee3c505b353378ea88c208
MD5 3c3148f199c29e75fa9a0a64159ffbf0
SHA1 fa1f6f88f9e43fddf8a838d7f5b5b564587dbe7f
SHA512 75ea9482189acb9f146f9318c90b790d85aad5ab69d7d13d9f53f06c03871b3a6eb41e925987baa4406621bf40bef4adf143498d1ca70dc315133f25bb45257c
SSDEEP 768:V6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:Y8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2184	omsecor.exe
3812	omsecor.exe
4888	omsecor.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1256-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x0005000000022f58-3.dat	upx
behavioral2/memory/1256-5-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2184-6-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2184-8-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2184-11-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2184-14-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2184-15-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x000b000000023454-18.dat	upx
behavioral2/memory/2184-20-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/3812-21-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x0005000000022f58-25.dat	upx
behavioral2/memory/3812-27-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4888-29-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4888-30-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4888-33-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 2184	1256	06a546b4b27844cddea97bde95a8a2dd3d591b087cee3c505b353378ea88c208_NeikiAnalytics.exe	83
PID 1256 wrote to memory of 2184	1256	06a546b4b27844cddea97bde95a8a2dd3d591b087cee3c505b353378ea88c208_NeikiAnalytics.exe	83
PID 1256 wrote to memory of 2184	1256	06a546b4b27844cddea97bde95a8a2dd3d591b087cee3c505b353378ea88c208_NeikiAnalytics.exe	83
PID 2184 wrote to memory of 3812	2184	omsecor.exe	99
PID 2184 wrote to memory of 3812	2184	omsecor.exe	99
PID 2184 wrote to memory of 3812	2184	omsecor.exe	99
PID 3812 wrote to memory of 4888	3812	omsecor.exe	100
PID 3812 wrote to memory of 4888	3812	omsecor.exe	100
PID 3812 wrote to memory of 4888	3812	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\06a546b4b27844cddea97bde95a8a2dd3d591b087cee3c505b353378ea88c208_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\06a546b4b27844cddea97bde95a8a2dd3d591b087cee3c505b353378ea88c208_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3812
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 b3b7ab0cb970c2ae57b6d3b3d8f29810bee6b284507b01138881c600b82c8b20
MD5 ffd1c310f02f5aee217e82d448eeb8af
SHA1 5016cebb3e47e8dc8089ce3072c95a5bb0c4ceb0
SHA512 ae7899b34ffe451567fd1f511d8b81e11c57dd65d9e8abd76051aab0b14322a7410981d199cf89b08ff642e1485bf0f4ac3c794cbb193f84bcac823b7d2a7513
SSDEEP 768:G6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:d8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 92a680a15710c5acd4962504813bcb0f15f4ab0509f587bcfef09fab73102a37
MD5 f45cc3f667a85f9006855cd3b6ecaf83
SHA1 51bbd0e2332e67f65e2322864bd158efd93f2dc6
SHA512 88c0fcd2852bac14c9e975979b19a30f3a5c35d7beb039dd21439ba1d55d95d1dd8f3f34c6431dfadf70e1b7f37fe9b7315207cf15924c45b747baf2e6b0cb30
SSDEEP 768:96vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:w8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 35KB
SHA256 741797a7d446d5c4eec7b43f0204963f0dddf540bec9faf6583560161ebed988
MD5 c641cd0fb46066b398cf98cf09031c24
SHA1 c89b6ffa773b2fb7140b2b1b3322346c04fff5ae
SHA512 0616d52c30e8356e9635272ffcfb6647be08b3bf35737fe1c8944436d39050909f482d78965f015f5b533419e9d2ae99f2945cb8f4fdb7cb91f300fac7ca7a73
SSDEEP 768:m6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:98Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1256-5-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1256-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2184-8-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2184-14-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2184-15-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2184-11-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2184-20-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2184-6-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3812-21-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3812-27-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4888-29-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4888-30-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4888-33-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads