neconyd | d71aa6a42f81041be03c1288277d1c87d4f3603c52e293a05a449ab801c834f4

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 10:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
089d08ec6616276ff1cae220e2950670.exe
Size 88KB
Sample240518-mjd12sfa65
SHA256 d71aa6a42f81041be03c1288277d1c87d4f3603c52e293a05a449ab801c834f4
MD5 089d08ec6616276ff1cae220e2950670
SHA1 2076cf001e3758bf2e2b4290a5de9b74dd04c4f1
SHA512 5dd524aba5b16ef2d501a267cc8fd7d903b525bd49c7268d7ce301921d153f023ed4e1c6d8b1cc7e8cdcd6e345ebaf4dbc6f33d14e8e7f5efde9d4b0e2d5b329
SSDEEP 768:2MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:2bIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2932	omsecor.exe
4228	omsecor.exe
3924	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 2932	1536	089d08ec6616276ff1cae220e2950670.exe	90
PID 1536 wrote to memory of 2932	1536	089d08ec6616276ff1cae220e2950670.exe	90
PID 1536 wrote to memory of 2932	1536	089d08ec6616276ff1cae220e2950670.exe	90
PID 2932 wrote to memory of 4228	2932	omsecor.exe	108
PID 2932 wrote to memory of 4228	2932	omsecor.exe	108
PID 2932 wrote to memory of 4228	2932	omsecor.exe	108
PID 4228 wrote to memory of 3924	4228	omsecor.exe	109
PID 4228 wrote to memory of 3924	4228	omsecor.exe	109
PID 4228 wrote to memory of 3924	4228	omsecor.exe	109

C:\Users\Admin\AppData\Local\Temp\089d08ec6616276ff1cae220e2950670.exe
"C:\Users\Admin\AppData\Local\Temp\089d08ec6616276ff1cae220e2950670.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3748,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
1⤵
PID:2104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 49c4ca748dc61c37bcc2243620fade0446a1796ca2a17318489e1bdedf972fbe
MD5 fa69ceac22cc05584d16a6442051effd
SHA1 4f8e0e7b48a9b5c5631804ca0a206e5d40fa85ee
SHA512 9227ecb390e3ebf6254c79f2f22785f182ee2f1ec343f6c47c467c8a260985e4dcb2154962d4695b47f42fd3a063b637eb1a13ac742f400fa4f7216a32d84872
SSDEEP 768:AMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:AbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 c66798963e5c504bda50ab5af8232737a417e4be9eeb45c70494c791c90f83a2
MD5 5f96d954893d5e65241d64a3e9b29e82
SHA1 80533e978fc6e3bc1ff2150ecf889a68f1c78b28
SHA512 b908cf00c87a3f8aefbc5977741f5e619a05df916f4fcb308ea5a03403019276321b2b98cc646dcdbef7541f170f03d5234321165d7a39a0c329fed5c8b5cef7
SSDEEP 768:RMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:RbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 cdccf064dd72da6fbae730fb2235a3314f75e3776d2b00b2c27585537ebddd4a
MD5 e3560a8c0053ae11c236c35d17d678aa
SHA1 44b2b3e379ce100c4773b9f7c641194eca4bcb4d
SHA512 ea7a3ae040af490c5ab5de27cb5e64adbb4cd2a77b0f443abe41bffc0d4e653df9722c2f936eefcb888625ba7a3ed04d87f2c24ac193765543de51942df4f896
SSDEEP 768:YMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:YbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads