neconyd | 2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe
Size 134KB
Sample240702-bftfsa1bqf
SHA256 2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a
MD5 f84edb5ec9838df02ce79f300a470d90
SHA1 73037128c1cfcf4d86abec02520a8f82e76dfd4e
SHA512 2f49df26df94e5d273aa732e2b95a58e6a253c33885b373c5d7b754b80abac15f89b5055a2c36ae7fcbcc6315344af110ed8f6a08cab9b3b0a6ee686b52d5a93
SSDEEP 1536:RDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:xiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
1500	omsecor.exe
1108	omsecor.exe
2300	omsecor.exe
412	omsecor.exe
4276	omsecor.exe
4084	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5108 set thread context of 4576	5108	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	85
PID 1500 set thread context of 1108	1500	omsecor.exe	89
PID 2300 set thread context of 412	2300	omsecor.exe	109
PID 4276 set thread context of 4084	4276	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1656	5108	WerFault.exe	84
3976	1500	WerFault.exe	87
1640	4276	WerFault.exe	111
5012	2300	WerFault.exe	108

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4576	5108	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	85
PID 5108 wrote to memory of 4576	5108	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	85
PID 5108 wrote to memory of 4576	5108	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	85
PID 5108 wrote to memory of 4576	5108	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	85
PID 5108 wrote to memory of 4576	5108	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	85
PID 4576 wrote to memory of 1500	4576	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	87
PID 4576 wrote to memory of 1500	4576	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	87
PID 4576 wrote to memory of 1500	4576	2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe	87
PID 1500 wrote to memory of 1108	1500	omsecor.exe	89
PID 1500 wrote to memory of 1108	1500	omsecor.exe	89
PID 1500 wrote to memory of 1108	1500	omsecor.exe	89
PID 1500 wrote to memory of 1108	1500	omsecor.exe	89
PID 1500 wrote to memory of 1108	1500	omsecor.exe	89
PID 1108 wrote to memory of 2300	1108	omsecor.exe	108
PID 1108 wrote to memory of 2300	1108	omsecor.exe	108
PID 1108 wrote to memory of 2300	1108	omsecor.exe	108
PID 2300 wrote to memory of 412	2300	omsecor.exe	109
PID 2300 wrote to memory of 412	2300	omsecor.exe	109
PID 2300 wrote to memory of 412	2300	omsecor.exe	109
PID 2300 wrote to memory of 412	2300	omsecor.exe	109
PID 2300 wrote to memory of 412	2300	omsecor.exe	109
PID 412 wrote to memory of 4276	412	omsecor.exe	111
PID 412 wrote to memory of 4276	412	omsecor.exe	111
PID 412 wrote to memory of 4276	412	omsecor.exe	111
PID 4276 wrote to memory of 4084	4276	omsecor.exe	112
PID 4276 wrote to memory of 4084	4276	omsecor.exe	112
PID 4276 wrote to memory of 4084	4276	omsecor.exe	112
PID 4276 wrote to memory of 4084	4276	omsecor.exe	112
PID 4276 wrote to memory of 4084	4276	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Users\Admin\AppData\Local\Temp\2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\2113dc820e082a6d3739b563cbd3e64ab3184dec68ba3b93d18a6d9a8771331a_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1108
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2300
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:412
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 268
        8⤵
        Program crash
        
        PID:1640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 292
        6⤵
        Program crash
        
        PID:5012
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 288
      4⤵
      Program crash
      PID:3976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 288
  2⤵
  - Program crash
  PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5108 -ip 5108
1⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1500 -ip 1500
1⤵
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2300 -ip 2300
1⤵
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4276 -ip 4276
1⤵
PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 2f15ae8f472f934f48ba50da0b1ae70f24ea0000b94560c109d7c41464d5010a
MD5 cb136379cc355aaecdf3826e6072305f
SHA1 79076b78ff4fd35e56d64efd66103d9f31e87cd8
SHA512 2abbe133e16cfe5bbdb66de8fbb923d0079b4fed69be6a7f7d3b5434c06e35d687c9f9a4d824da7104f53cf1520fdec37416febe15dd59b2b3f6a12fdb42ce4d
SSDEEP 1536:KDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:siRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 9d405595189613ee1975ade8d178a6f30c02c894a4bbdc45199204f11897f1ee
MD5 58b2a4567174852e02617e7bce5eb17a
SHA1 b2ad1a42bc441ed78a1e16495335a0f7f5674c86
SHA512 c14233afb4b4b66896d62896b40fe7354dcf58c300d12155ebc8b270665712f113a620ee05bca1b88175e5cb88a3f10ec2119bc86065fde51f494fe06ef67adb
SSDEEP 1536:RDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:xiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 134KB
SHA256 2e83ceef211bbd23f98373095b71aa9f8a8adf5fa4c38e1c455dbc7a24fe97eb
MD5 58681b2dbd3a16acf9a5868363da7878
SHA1 58cd00c0dc785f305d5d32a17e11a5ae4c4ddba9
SHA512 d63856c21c2e5e1bbf4d2da6d9e81dbf5cd1dea724b9f6c7c58d2e3713597d3e153bee268d23c8a964b709dc75e22f78a21bbcd1dd6fe1e44b0cd9be1c5b1a1a
SSDEEP 1536:WDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:IiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/412-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/412-41-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1108-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1108-30-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1108-16-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1108-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1108-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1108-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1108-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1500-18-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1500-9-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2300-33-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4084-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4084-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4084-50-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4084-53-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4276-44-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4576-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4576-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4576-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4576-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5108-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5108-17-0x0000000000400000-0x0000000000424000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads