neconyd | 1a3a50e0b846fa152182f672e97991d0c414c54c282b3b0d3a6fdf2974e88066

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
034a689526180b789e452c9aa8413780.exe
Size 134KB
Sample240519-ln7y9acd77
SHA256 1a3a50e0b846fa152182f672e97991d0c414c54c282b3b0d3a6fdf2974e88066
MD5 034a689526180b789e452c9aa8413780
SHA1 fb3eba1cb5aabe2ea27cc67ad9b83750a648f8a6
SHA512 2a0f1174c71dfb0f4ecfc9f1d2b935b5ec9dd1079873918c1f659c0fd82a467dbd8f7f3d0e2a230620cedb4179c2b488306eba70943c499744ec2a59665d7725
SSDEEP 1536:EDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:aiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
4588	omsecor.exe
1092	omsecor.exe
3740	omsecor.exe
2136	omsecor.exe
2900	omsecor.exe
660	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3236 set thread context of 2016	3236	034a689526180b789e452c9aa8413780.exe	83
PID 4588 set thread context of 1092	4588	omsecor.exe	86
PID 3740 set thread context of 2136	3740	omsecor.exe	108
PID 2900 set thread context of 660	2900	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3380	4588	WerFault.exe	85
4648	3236	WerFault.exe	82
3576	3740	WerFault.exe	107
3512	2900	WerFault.exe	110

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 2016	3236	034a689526180b789e452c9aa8413780.exe	83
PID 3236 wrote to memory of 2016	3236	034a689526180b789e452c9aa8413780.exe	83
PID 3236 wrote to memory of 2016	3236	034a689526180b789e452c9aa8413780.exe	83
PID 3236 wrote to memory of 2016	3236	034a689526180b789e452c9aa8413780.exe	83
PID 3236 wrote to memory of 2016	3236	034a689526180b789e452c9aa8413780.exe	83
PID 2016 wrote to memory of 4588	2016	034a689526180b789e452c9aa8413780.exe	85
PID 2016 wrote to memory of 4588	2016	034a689526180b789e452c9aa8413780.exe	85
PID 2016 wrote to memory of 4588	2016	034a689526180b789e452c9aa8413780.exe	85
PID 4588 wrote to memory of 1092	4588	omsecor.exe	86
PID 4588 wrote to memory of 1092	4588	omsecor.exe	86
PID 4588 wrote to memory of 1092	4588	omsecor.exe	86
PID 4588 wrote to memory of 1092	4588	omsecor.exe	86
PID 4588 wrote to memory of 1092	4588	omsecor.exe	86
PID 1092 wrote to memory of 3740	1092	omsecor.exe	107
PID 1092 wrote to memory of 3740	1092	omsecor.exe	107
PID 1092 wrote to memory of 3740	1092	omsecor.exe	107
PID 3740 wrote to memory of 2136	3740	omsecor.exe	108
PID 3740 wrote to memory of 2136	3740	omsecor.exe	108
PID 3740 wrote to memory of 2136	3740	omsecor.exe	108
PID 3740 wrote to memory of 2136	3740	omsecor.exe	108
PID 3740 wrote to memory of 2136	3740	omsecor.exe	108
PID 2136 wrote to memory of 2900	2136	omsecor.exe	110
PID 2136 wrote to memory of 2900	2136	omsecor.exe	110
PID 2136 wrote to memory of 2900	2136	omsecor.exe	110
PID 2900 wrote to memory of 660	2900	omsecor.exe	112
PID 2900 wrote to memory of 660	2900	omsecor.exe	112
PID 2900 wrote to memory of 660	2900	omsecor.exe	112
PID 2900 wrote to memory of 660	2900	omsecor.exe	112
PID 2900 wrote to memory of 660	2900	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\034a689526180b789e452c9aa8413780.exe
"C:\Users\Admin\AppData\Local\Temp\034a689526180b789e452c9aa8413780.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Users\Admin\AppData\Local\Temp\034a689526180b789e452c9aa8413780.exe
  C:\Users\Admin\AppData\Local\Temp\034a689526180b789e452c9aa8413780.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1092
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3740
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 256
        8⤵
        Program crash
        
        PID:3512
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 292
        6⤵
        Program crash
        
        PID:3576
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 300
      4⤵
      Program crash
      PID:3380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 288
  2⤵
  - Program crash
  PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3236 -ip 3236
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4588 -ip 4588
1⤵
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3740 -ip 3740
1⤵
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2900 -ip 2900
1⤵
PID:3124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 83c8277eefad1bb226c6c936f13da4e3cf1f04a7bee527abe062f7d0360bad6a
MD5 aaf1da9c5eda83f2a824c736b3c6a296
SHA1 28deae2758fe1adf89d61c90519e60604f172944
SHA512 d2e7192b5d2f765827c0d7a4b6e60ed8f327062b03dfd6d213d0efd4dd9518e397382f1559ee6a75c8301d45572ca4ec04686a8e1b0b08348377720330eb59ea
SSDEEP 1536:KDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:siRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 82328316e1274abc7ddff6661a950e67c96c02403293455bd77785d31a2c200a
MD5 bcb27c245c1d828e1ac932d1e8515fb3
SHA1 23866057270e01511ac4831b61c6271fa962ad39
SHA512 b05d3fc7f0914402471bc016d58262fee5a4fdb0edb2bcde49c06bd776ede0d666d7b4176c5e9dddc18e01e40639383b0bfad68f21e6419ca325eb6744b8f610
SSDEEP 1536:IDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:uiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 134KB
SHA256 3fa328021546e3c8f4b16b99f00ef6d262d6ffc3b7484c6c053449a9bdda2fcb
MD5 09e22104f39d08d0ea19a00a97c20a69
SHA1 15d6f34715e3ca327d41d0d95015f9bca7401310
SHA512 abfacd4488d20e78b7e0e432231a5048c085757cd3c0f79c9300862e9d5d825a1ac1dc50356d1c1e8800fd6f76d2441875967ad140321e1566aad3bfdf1cf3ce
SSDEEP 1536:SDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:EiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/660-53-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/660-50-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/660-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/660-47-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1092-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1092-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1092-29-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1092-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1092-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1092-16-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1092-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2016-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2016-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2016-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2016-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2136-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2136-40-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2136-35-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2900-43-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3236-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3236-17-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3740-49-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3740-32-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4588-11-0x0000000000400000-0x0000000000424000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads