neconyd | c01a354121c3d96dab4f4a9d86d6328e830649b8ec2795c32127a25484c1985e

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c01a354121c3d96dab4f4a9d86d6328e830649b8ec2795c32127a25484c1985e.exe
Size 96KB
Sample240519-chpfaach6x
SHA256 c01a354121c3d96dab4f4a9d86d6328e830649b8ec2795c32127a25484c1985e
MD5 9bd485b5677dd21fe07d2a29c8fed1de
SHA1 f131e272113a58552df678e85c0a8da593371eac
SHA512 72520dd0c4804d709c02ebd714e1a65466b493fa776eb4eca143767924dd714ee4b954dc46da1a3641b8c3e75376da6c1c18508297b35f0d814beffc3e749588
SSDEEP 1536:vnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:vGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Detects executables built or packed with MPress PE compressor 8 IoCs

resource	yara_rule
behavioral2/memory/4064-0-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0008000000023444-10.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4348-11-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000b000000023453-31.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3728-33-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0008000000023444-41.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/944-42-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/944-50-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 6 IoCs

pid	Process
4348	omsecor.exe
4444	omsecor.exe
3728	omsecor.exe
4440	omsecor.exe
944	omsecor.exe
1540	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4064 set thread context of 2788	4064	c01a354121c3d96dab4f4a9d86d6328e830649b8ec2795c32127a25484c1985e.exe	85
PID 4348 set thread context of 4444	4348	omsecor.exe	89
PID 3728 set thread context of 4440	3728	omsecor.exe	110
PID 944 set thread context of 1540	944	omsecor.exe	114

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3660	4064	WerFault.exe	84
3856	4348	WerFault.exe	87
4324	3728	WerFault.exe	109
4544	944	WerFault.exe	112

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 2788	4064	c01a354121c3d96dab4f4a9d86d6328e830649b8ec2795c32127a25484c1985e.exe	85
PID 4064 wrote to memory of 2788	4064	c01a354121c3d96dab4f4a9d86d6328e830649b8ec2795c32127a25484c1985e.exe	85
PID 4064 wrote to memory of 2788	4064	c01a354121c3d96dab4f4a9d86d6328e830649b8ec2795c32127a25484c1985e.exe	85
PID 4064 wrote to memory of 2788	4064	c01a354121c3d96dab4f4a9d86d6328e830649b8ec2795c32127a25484c1985e.exe	85
PID 4064 wrote to memory of 2788	4064	c01a354121c3d96dab4f4a9d86d6328e830649b8ec2795c32127a25484c1985e.exe	85
PID 2788 wrote to memory of 4348	2788	c01a354121c3d96dab4f4a9d86d6328e830649b8ec2795c32127a25484c1985e.exe	87
PID 2788 wrote to memory of 4348	2788	c01a354121c3d96dab4f4a9d86d6328e830649b8ec2795c32127a25484c1985e.exe	87
PID 2788 wrote to memory of 4348	2788	c01a354121c3d96dab4f4a9d86d6328e830649b8ec2795c32127a25484c1985e.exe	87
PID 4348 wrote to memory of 4444	4348	omsecor.exe	89
PID 4348 wrote to memory of 4444	4348	omsecor.exe	89
PID 4348 wrote to memory of 4444	4348	omsecor.exe	89
PID 4348 wrote to memory of 4444	4348	omsecor.exe	89
PID 4348 wrote to memory of 4444	4348	omsecor.exe	89
PID 4444 wrote to memory of 3728	4444	omsecor.exe	109
PID 4444 wrote to memory of 3728	4444	omsecor.exe	109
PID 4444 wrote to memory of 3728	4444	omsecor.exe	109
PID 3728 wrote to memory of 4440	3728	omsecor.exe	110
PID 3728 wrote to memory of 4440	3728	omsecor.exe	110
PID 3728 wrote to memory of 4440	3728	omsecor.exe	110
PID 3728 wrote to memory of 4440	3728	omsecor.exe	110
PID 3728 wrote to memory of 4440	3728	omsecor.exe	110
PID 4440 wrote to memory of 944	4440	omsecor.exe	112
PID 4440 wrote to memory of 944	4440	omsecor.exe	112
PID 4440 wrote to memory of 944	4440	omsecor.exe	112
PID 944 wrote to memory of 1540	944	omsecor.exe	114
PID 944 wrote to memory of 1540	944	omsecor.exe	114
PID 944 wrote to memory of 1540	944	omsecor.exe	114
PID 944 wrote to memory of 1540	944	omsecor.exe	114
PID 944 wrote to memory of 1540	944	omsecor.exe	114

C:\Users\Admin\AppData\Local\Temp\c01a354121c3d96dab4f4a9d86d6328e830649b8ec2795c32127a25484c1985e.exe
"C:\Users\Admin\AppData\Local\Temp\c01a354121c3d96dab4f4a9d86d6328e830649b8ec2795c32127a25484c1985e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Users\Admin\AppData\Local\Temp\c01a354121c3d96dab4f4a9d86d6328e830649b8ec2795c32127a25484c1985e.exe
  C:\Users\Admin\AppData\Local\Temp\c01a354121c3d96dab4f4a9d86d6328e830649b8ec2795c32127a25484c1985e.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4444
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3728
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:944
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:1540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 256
        8⤵
        Program crash
        
        PID:4544
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 292
        6⤵
        Program crash
        
        PID:4324
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 300
      4⤵
      Program crash
      PID:3856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 288
  2⤵
  - Program crash
  PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4064 -ip 4064
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4348 -ip 4348
1⤵
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3728 -ip 3728
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 944 -ip 944
1⤵
PID:1160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 1b4f2cc863028c36b80aaf516a6ebf483a1f363d5d5eb3aa335001c69c2ae3ea
MD5 61c1e79b9c4dce8eee25a892bd196e7c
SHA1 df19a7ea0cc0f8566f2c7b11d9cdcafd88a0895c
SHA512 75b982c8be2a26b5e4af9ae2065375d5b387cef2b6c9f116201d655eb3af7efeb966b9df31b61abef60f0eea0a9c4a6923e4d528951fbcfe868aebf45d5016f6
SSDEEP 1536:7nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:7Gs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 3bd422ff88dec0c4288470a170b93fb25a95a5f006116db3db004be9ebaaba47
MD5 a37f3f47f478882bc8811e118409ea64
SHA1 f0168783983b1e6189bc18813b95e117f1ae6150
SHA512 8893ef9776e07f60b9df1fab71159deb014bf201269ba2f962832fb1eabdd712d09edea37a59650cfa9539227ae77cfdff3fd5195340a3f2d99076b70ba06f54
SSDEEP 1536:onAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:oGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 99f5d60f892d827facf5ef9c3251d82bb93e5eca0b6002de2c5b64b3036aaa66
MD5 24a00c7fbe2d970da026f16ec0fa21b7
SHA1 33f90c1961e338217d0d21e539a7ee280c6d6c20
SHA512 2a2bdddf3f22750abe3002494e360add47ca2302afc75d988553404bfcb0e2e444bbda9649a614257f6afc44fd803d0f14461f85af1795c9758c58095d4164f5
SSDEEP 1536:0nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:0Gs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/944-50-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/944-42-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1540-47-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1540-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1540-55-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1540-52-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2788-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2788-7-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2788-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2788-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3728-33-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4064-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4348-11-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4440-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4440-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4440-40-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4444-32-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4444-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4444-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4444-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4444-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4444-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4444-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads