neconyd | c6849610e3726e0357589ed6e6d73af776acfc973e9962c54481a1d27017f08c

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c6849610e3726e0357589ed6e6d73af776acfc973e9962c54481a1d27017f08c.exe
Size 68KB
Sample240519-qfw91aaa89
SHA256 c6849610e3726e0357589ed6e6d73af776acfc973e9962c54481a1d27017f08c
MD5 0e61f697903f2f1e4c62b7b7ead22ca0
SHA1 31175b35b97480e286ba36c51d2b5be694e6bebf
SHA512 ec6455200c360ebb104a24971ac271b2747c4e3ee8399f080d509b2ebb138ecc296806dcefaf027f3f66b29a9c3996f975af93b802814a6a36662754581c701c
SSDEEP 1536:Rd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:hdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
312	omsecor.exe
1188	omsecor.exe
3232	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 312	4272	c6849610e3726e0357589ed6e6d73af776acfc973e9962c54481a1d27017f08c.exe	83
PID 4272 wrote to memory of 312	4272	c6849610e3726e0357589ed6e6d73af776acfc973e9962c54481a1d27017f08c.exe	83
PID 4272 wrote to memory of 312	4272	c6849610e3726e0357589ed6e6d73af776acfc973e9962c54481a1d27017f08c.exe	83
PID 312 wrote to memory of 1188	312	omsecor.exe	99
PID 312 wrote to memory of 1188	312	omsecor.exe	99
PID 312 wrote to memory of 1188	312	omsecor.exe	99
PID 1188 wrote to memory of 3232	1188	omsecor.exe	100
PID 1188 wrote to memory of 3232	1188	omsecor.exe	100
PID 1188 wrote to memory of 3232	1188	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\c6849610e3726e0357589ed6e6d73af776acfc973e9962c54481a1d27017f08c.exe
"C:\Users\Admin\AppData\Local\Temp\c6849610e3726e0357589ed6e6d73af776acfc973e9962c54481a1d27017f08c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:312
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1188
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 68KB
SHA256 ad45ab593f581c1c9960d476f54f6831974e3f69304218a318cbff8b50032a64
MD5 571d74bab820d4a9e772d8d1bd6083f7
SHA1 530124db5c7b10d9b0e9654c2927765258a37f8e
SHA512 5140b1572500b0dc419f5271b4ad22dd11c87efaffbc2c60f8e217b3ac427bb4cbe0d8524da8a959d3527994e283bf20c6489d5894b13316aa00f0f5349e9959
SSDEEP 1536:Od9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:WdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 68KB
SHA256 9c3a1081090ba856170e3ea3f2005505ecbce4ae74256444a562c4d957e7f118
MD5 04e689d274cb2226c91b9797b9ba38d4
SHA1 632e15d3fb0944f4e6f5fe5f12fc4424942b7f67
SHA512 8f11355adf9bd71643ffabd72fb27066edc9266678e267be0600143a8cfb509ce6e30fba85f8cbe4f2d8a7ebc84c02845ca608d8eabbb2eaea3891173f370b52
SSDEEP 1536:ld9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:NdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 68KB
SHA256 63fb031ec9002fd2691848c0ac2cfe689bd546a2f6e8249b6edfece48ab689b3
MD5 0ca0a63e3b182ac473b17cf9d448debc
SHA1 061b7a4d56f11366aaae9d04b27a65c446bea5db
SHA512 5ae7d71871a88f881c27b6c2b115666028315d401353d3ecb9840b9c266f138e7925ef1a6bfd9ad17a881042f6117735c45555fed61fc7305678893582ff7ae8
SSDEEP 1536:md9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:edseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads