neconyd | 015e20b9ec38a7c115693165f828eafba397a7b6a0b791da874e9815a8e0bd7c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
015e20b9ec38a7c115693165f828eafba397a7b6a0b791da874e9815a8e0bd7c_NeikiAnalytics.exe
Size 71KB
Sample240702-tdlbhazepd
SHA256 015e20b9ec38a7c115693165f828eafba397a7b6a0b791da874e9815a8e0bd7c
MD5 5dee7425c4f33a4c7093fa5d1a04d9b0
SHA1 941b35c801c00b8fd94a0f96db00703b9ece13e0
SHA512 560d86bd1357e5cddb1cd51d8ebfc586b9988103a57279e56100752f489a875acb17f7f024bbae9da42c4ce2584c4ff9a8df2a1c4cf9320d3cde44540c2c8c6a
SSDEEP 1536:Pd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:ndseIOMEZEyFjEOFqTiQmQDHIbH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4580	omsecor.exe
3460	omsecor.exe
4488	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 4580	2660	015e20b9ec38a7c115693165f828eafba397a7b6a0b791da874e9815a8e0bd7c_NeikiAnalytics.exe	80
PID 2660 wrote to memory of 4580	2660	015e20b9ec38a7c115693165f828eafba397a7b6a0b791da874e9815a8e0bd7c_NeikiAnalytics.exe	80
PID 2660 wrote to memory of 4580	2660	015e20b9ec38a7c115693165f828eafba397a7b6a0b791da874e9815a8e0bd7c_NeikiAnalytics.exe	80
PID 4580 wrote to memory of 3460	4580	omsecor.exe	91
PID 4580 wrote to memory of 3460	4580	omsecor.exe	91
PID 4580 wrote to memory of 3460	4580	omsecor.exe	91
PID 3460 wrote to memory of 4488	3460	omsecor.exe	92
PID 3460 wrote to memory of 4488	3460	omsecor.exe	92
PID 3460 wrote to memory of 4488	3460	omsecor.exe	92

C:\Users\Admin\AppData\Local\Temp\015e20b9ec38a7c115693165f828eafba397a7b6a0b791da874e9815a8e0bd7c_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\015e20b9ec38a7c115693165f828eafba397a7b6a0b791da874e9815a8e0bd7c_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 71KB
SHA256 707a9d38cc5b0ced6f0ad87c6e8c7186090d5069557ddd5573d21e6bd180d0a7
MD5 46f6e6ecea5210546404041b09d38542
SHA1 3fa57a2a43cf9ff9ab0abea46828aeb445fb93b2
SHA512 b4c35d3283a4b80ef80dfc096f770a7bcf27bd6417c86c86e04f30502c57f7a4286542870308707154fd3746ed14215db1adcce8ba02baeb13c8b04407ebc5a7
SSDEEP 1536:pd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:pdseIOMEZEyFjEOFqTiQmQDHIbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 71KB
SHA256 7a7e96623a92a52cb950cb7b2b821bbfa5dca3e6e526a5a33d54c748a84660b3
MD5 83120bc607c53a6fe220dfa092864574
SHA1 faca0d5a1a823bdc1e34e87249cc6e9150bc0969
SHA512 e585d13146f9b98d8a49936d0f0df0800bf4fc24563a63bcc114d68e7ac362316175d858db62f92572c5b4c0c92fa81062ffb88456b9515c437bfd2353f0687b
SSDEEP 1536:Td9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:TdseIOMEZEyFjEOFqTiQmQDHIbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 71KB
SHA256 c810838b528b8e734dfafbcb385331350cc1fc8fe8c138bde86e1bdf2655ee61
MD5 ea9f7876f64c09def8041eb876e12a2c
SHA1 49567057efc7a325a789b954218b90552dddcad9
SHA512 50853cdfe774dfb22fcb6e4cbf4310a6cbed37785712107cb87f2b831242c543a1f1fcbd271b5ee07dbc1b6b4d7c77688b9ccdb0e8f2f25aaf1d43b9c793e76b
SSDEEP 1536:Bd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:xdseIOMEZEyFjEOFqTiQmQDHIbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2660-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2660-4-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3460-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3460-17-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4488-18-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4488-20-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4580-5-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4580-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4580-11-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads