neconyd | 2d6905023f455d2e409d055dd31b0ec1c865dbe853a55fc155be8b43df7b537d

Analysis

max time kernel
142s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2d6905023f455d2e409d055dd31b0ec1c865dbe853a55fc155be8b43df7b537d_NeikiAnalytics.exe
Size 61KB
Sample240702-ds52fsxdkp
SHA256 2d6905023f455d2e409d055dd31b0ec1c865dbe853a55fc155be8b43df7b537d
MD5 fe9c3051ca41e0652b44131e928908c0
SHA1 4047e56e7d7b339995ab1d3e04f61f465e807318
SHA512 826b0600eadd57c2662690a805bf6904f712265041b153f576dc9eb13fbb25276d61ce3ba6809fffb18915dce5f947ebc97cce608f3b71026126f640aa43a295
SSDEEP 1536:Cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZcl/5:ydseIOMEZEyFjEOFqTiQmql/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1732	omsecor.exe
1636	omsecor.exe
3120	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 1732	4724	2d6905023f455d2e409d055dd31b0ec1c865dbe853a55fc155be8b43df7b537d_NeikiAnalytics.exe	81
PID 4724 wrote to memory of 1732	4724	2d6905023f455d2e409d055dd31b0ec1c865dbe853a55fc155be8b43df7b537d_NeikiAnalytics.exe	81
PID 4724 wrote to memory of 1732	4724	2d6905023f455d2e409d055dd31b0ec1c865dbe853a55fc155be8b43df7b537d_NeikiAnalytics.exe	81
PID 1732 wrote to memory of 1636	1732	omsecor.exe	90
PID 1732 wrote to memory of 1636	1732	omsecor.exe	90
PID 1732 wrote to memory of 1636	1732	omsecor.exe	90
PID 1636 wrote to memory of 3120	1636	omsecor.exe	91
PID 1636 wrote to memory of 3120	1636	omsecor.exe	91
PID 1636 wrote to memory of 3120	1636	omsecor.exe	91

C:\Users\Admin\AppData\Local\Temp\2d6905023f455d2e409d055dd31b0ec1c865dbe853a55fc155be8b43df7b537d_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2d6905023f455d2e409d055dd31b0ec1c865dbe853a55fc155be8b43df7b537d_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 7a64b3b10a1829e870edcedfb36841209fcbfc4e28fee3733084a20f7705ed64
MD5 5af0a5c15ac67ae473738dbd6967d689
SHA1 0e2ad54cadd574d0ee3e2a22cf36acf2ecfaaba8
SHA512 54b82d0b9b484ed533d93b60d440ef0e06cac6590a4729cb9cf7de21e1dbf7a515b716511f19b6509018a0b460994ceef5b0004a019a0e85983d18747d36ec3a
SSDEEP 1536:3d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZcl/5:/dseIOMEZEyFjEOFqTiQmql/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 19edd2585a8641d77e512cc6b4516c16800efa33465fe003c403b16a2445f0a6
MD5 aa06acd3713f5d6c3e1b59953ce4bc49
SHA1 c56c26bc5db992fcb3dd9f4116289b442bedd636
SHA512 ba4386dbb9c5894a57c43e1a87e3a04860b3369f0a90611623e8c2dbb9d19bf86216052c2d48b82353113ffa4db8f954ad49b11ed0499afe9c9953fffe119e83
SSDEEP 1536:rd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZcl/5:bdseIOMEZEyFjEOFqTiQmql/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 61KB
SHA256 db0c03e38af9f83a92e42dc38b7da3f212d23a6c6160e923dcd75d3bab818964
MD5 f7470daf2061b1193921b4088160fdcc
SHA1 c2795441383cb615944b8c3724fa6d3e7b6b8d6f
SHA512 6875ca1d77bf7082b9e7196fb0f4f790e799ad314a7ef08f39b4602772773f2f3f35afcaaf14a3789768c19571457f9755df1a7a65cd6068c4777401dfd86e31
SSDEEP 1536:bd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZcl/5:rdseIOMEZEyFjEOFqTiQmql/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads