neconyd | 3b9bafb5cc50b462e58329ef14449e4163c9b5d0580d1aa35fcf542348fe3853

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3b9bafb5cc50b462e58329ef14449e4163c9b5d0580d1aa35fcf542348fe3853.exe
Size 76KB
Sample240519-l9dmjadf24
SHA256 3b9bafb5cc50b462e58329ef14449e4163c9b5d0580d1aa35fcf542348fe3853
MD5 cc1d0c32bb592df7f30df5ebb5193310
SHA1 5a69f3ecdefaf0e23eec5483696ebaa1aded4b13
SHA512 afdf4b0798f178891c207ced3df0dd0b7a3be2ab01b078871b7062c83d1d3ed4180b0ee7049470c3952feb62f566a6dd44b7e3f029d31811f65383eee4b4cdf3
SSDEEP 1536:Id9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:4dseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
1792	omsecor.exe
2884	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 1792	5056	3b9bafb5cc50b462e58329ef14449e4163c9b5d0580d1aa35fcf542348fe3853.exe	83
PID 5056 wrote to memory of 1792	5056	3b9bafb5cc50b462e58329ef14449e4163c9b5d0580d1aa35fcf542348fe3853.exe	83
PID 5056 wrote to memory of 1792	5056	3b9bafb5cc50b462e58329ef14449e4163c9b5d0580d1aa35fcf542348fe3853.exe	83
PID 1792 wrote to memory of 2884	1792	omsecor.exe	101
PID 1792 wrote to memory of 2884	1792	omsecor.exe	101
PID 1792 wrote to memory of 2884	1792	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\3b9bafb5cc50b462e58329ef14449e4163c9b5d0580d1aa35fcf542348fe3853.exe
"C:\Users\Admin\AppData\Local\Temp\3b9bafb5cc50b462e58329ef14449e4163c9b5d0580d1aa35fcf542348fe3853.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:2884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 414ab18389e7dcf4c95508dd3e3e8c22b2d80a57a310b9c06a88d18370166597
MD5 ee34eabef0928b2a3fda1352da53d141
SHA1 acf6f4428f9cbc7ad5e7c210f16fbe061166f248
SHA512 bec44bcc4ccd4a2f76d7c70f7b415acd7cef699e8658cfd7bbfd27552208a99281fdec49d22fc699bfda4e6166a84930a3d35c9a712b64933c9d1e54a4c5fcb1
SSDEEP 1536:kd9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:cdseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 e372097cba8a8d792cff511fd28523e5c81748d6cd30b5979340548e8c5f8ca6
MD5 ad0b57cf87f43d3b429c66c76c1d074e
SHA1 3d04e75aa0665cec8d4242358fad41b12a4cc043
SHA512 e3b6bda239480bffe5980b7935fb977400efd7be1f5f840420e4e68dc3543b0e52fc0b2a4e1ebbc5b2bf31745b4bc5e4ea7241db5725b2eef704a72249a06ca5
SSDEEP 1536:zd9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:zdseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1792-6-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1792-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1792-11-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2884-13-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2884-14-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5056-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5056-4-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads