neconyd | 2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02/07/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe
Size 134KB
Sample240702-bftfsa1bqf
SHA256 2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a
MD5 f84edb5ec9838df02ce79f300a470d90
SHA1 73037128c1cfcf4d86abec02520a8f82e76dfd4e
SHA512 2f49df26df94e5d273aa732e2b95a58e6a253c33885b373c5d7b754b80abac15f89b5055a2c36ae7fcbcc6315344af110ed8f6a08cab9b3b0a6ee686b52d5a93
SSDEEP 1536:RDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:xiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
2484	omsecor.exe
2568	omsecor.exe
112	omsecor.exe
1256	omsecor.exe
2416	omsecor.exe
3048	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2216	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe
2216	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe
2484	omsecor.exe
2568	omsecor.exe
2568	omsecor.exe
1256	omsecor.exe
1256	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3012 set thread context of 2216	3012	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	28
PID 2484 set thread context of 2568	2484	omsecor.exe	30
PID 112 set thread context of 1256	112	omsecor.exe	35
PID 2416 set thread context of 3048	2416	omsecor.exe	37

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2216	3012	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	28
PID 3012 wrote to memory of 2216	3012	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	28
PID 3012 wrote to memory of 2216	3012	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	28
PID 3012 wrote to memory of 2216	3012	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	28
PID 3012 wrote to memory of 2216	3012	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	28
PID 3012 wrote to memory of 2216	3012	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	28
PID 2216 wrote to memory of 2484	2216	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	29
PID 2216 wrote to memory of 2484	2216	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	29
PID 2216 wrote to memory of 2484	2216	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	29
PID 2216 wrote to memory of 2484	2216	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	29
PID 2484 wrote to memory of 2568	2484	omsecor.exe	30
PID 2484 wrote to memory of 2568	2484	omsecor.exe	30
PID 2484 wrote to memory of 2568	2484	omsecor.exe	30
PID 2484 wrote to memory of 2568	2484	omsecor.exe	30
PID 2484 wrote to memory of 2568	2484	omsecor.exe	30
PID 2484 wrote to memory of 2568	2484	omsecor.exe	30
PID 2568 wrote to memory of 112	2568	omsecor.exe	34
PID 2568 wrote to memory of 112	2568	omsecor.exe	34
PID 2568 wrote to memory of 112	2568	omsecor.exe	34
PID 2568 wrote to memory of 112	2568	omsecor.exe	34
PID 112 wrote to memory of 1256	112	omsecor.exe	35
PID 112 wrote to memory of 1256	112	omsecor.exe	35
PID 112 wrote to memory of 1256	112	omsecor.exe	35
PID 112 wrote to memory of 1256	112	omsecor.exe	35
PID 112 wrote to memory of 1256	112	omsecor.exe	35
PID 112 wrote to memory of 1256	112	omsecor.exe	35
PID 1256 wrote to memory of 2416	1256	omsecor.exe	36
PID 1256 wrote to memory of 2416	1256	omsecor.exe	36
PID 1256 wrote to memory of 2416	1256	omsecor.exe	36
PID 1256 wrote to memory of 2416	1256	omsecor.exe	36
PID 2416 wrote to memory of 3048	2416	omsecor.exe	37
PID 2416 wrote to memory of 3048	2416	omsecor.exe	37
PID 2416 wrote to memory of 3048	2416	omsecor.exe	37
PID 2416 wrote to memory of 3048	2416	omsecor.exe	37
PID 2416 wrote to memory of 3048	2416	omsecor.exe	37
PID 2416 wrote to memory of 3048	2416	omsecor.exe	37

C:\Users\Admin\AppData\Local\Temp\2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:112
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1256
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 f9fec63405189c72ca37d3a5137facb079ca3148303b5a0220a596471a05091e
MD5 7ca4f4ef921ef357c3b7bd766d6193ab
SHA1 1c74503a402c1644a6a78b3715ee949a90f72b54
SHA512 024a008d501bc10700ec6101f3fc3ef504691f65b94c423e6e509df04a90a2896a0528b4d4c2bcdcde326624f88addfef68226c1fdf858865ea3b6098a233569
SSDEEP 1536:ADfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:2iRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 9d405595189613ee1975ade8d178a6f30c02c894a4bbdc45199204f11897f1ee
MD5 58b2a4567174852e02617e7bce5eb17a
SHA1 b2ad1a42bc441ed78a1e16495335a0f7f5674c86
SHA512 c14233afb4b4b66896d62896b40fe7354dcf58c300d12155ebc8b270665712f113a620ee05bca1b88175e5cb88a3f10ec2119bc86065fde51f494fe06ef67adb
SSDEEP 1536:RDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:xiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 134KB
SHA256 21ae9678cdafd7dfb15a2374b78505b0d39df74ae13236c207f46c0279e5766c
MD5 3adc62166077fdf944d51699d47c3d45
SHA1 549bc18971bc28931e0c2cfc4e0a7f42ac454fcc
SHA512 4b9f42e1dd37040b1107c2c076b7ab8967476b6070d23c5cd84323f2bea09362cffba096c8c92e63e6cfc1500ccb873e5c995d7525eac0b9fb096a7932138eea
SSDEEP 1536:gDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:WiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/112-63-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/112-55-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2216-12-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2216-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2216-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2216-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2216-9-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2216-13-0x00000000001C0000-0x00000000001E4000-memory.dmp

Download

memory/2416-83-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2416-76-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2484-22-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2484-31-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2568-43-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2568-46-0x0000000000290000-0x00000000002B4000-memory.dmp

Download

memory/2568-52-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2568-40-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2568-34-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3012-7-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3012-8-0x0000000000240000-0x0000000000264000-memory.dmp

Download

memory/3012-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3048-85-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3048-88-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads