Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 02:59

General

  • Target

    cfd0f0a7d6a5a2c71cf05d6d3d88a2d2c5b49e1a8645cf902c06e5638005ab43.exe

  • Size

    92KB

  • MD5

    a8b1ada55fa84ab373638e59a7cbaaa9

  • SHA1

    ff5ec3aae893f55553f0ea26c290cf07ec29d7b5

  • SHA256

    cfd0f0a7d6a5a2c71cf05d6d3d88a2d2c5b49e1a8645cf902c06e5638005ab43

  • SHA512

    f29ce5b8bb4a7f4354ca4ec4f7d6d6ed66283e4dcfbc850c59235c272b05adca18ee14eed8a51c1a06f82d9ff60bf4139d29c8eb319c14ddcbd500b95c51395d

  • SSDEEP

    1536:1d9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5:9dseIOyEZEyFjEOFqTiQm5l/5

Score
10/10

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Executes dropped EXE 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cfd0f0a7d6a5a2c71cf05d6d3d88a2d2c5b49e1a8645cf902c06e5638005ab43.exe
    "C:\Users\Admin\AppData\Local\Temp\cfd0f0a7d6a5a2c71cf05d6d3d88a2d2c5b49e1a8645cf902c06e5638005ab43.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2660
    • C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4684
      • C:\Windows\SysWOW64\omsecor.exe
        C:\Windows\System32\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4384
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          PID:216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    92KB

    MD5

    ff0a69a7db828df49bce7dcc139af561

    SHA1

    fa228fb63e66d1f786ff76ae7b7e502b1bea4e3d

    SHA256

    f04b2aa2512580bbe0bce86589f4f4f83504c75dfbbfa96a1d3570313c248704

    SHA512

    026d412dd9470b2f41ecd195a0b4ee2b9802ecd157b37311fcd6f3842e2b58c8e1e25ade824646b44f83cc5ed3eba862ef653200c879b1445d1349674dbb602a

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    92KB

    MD5

    30bbb6b75769c5bb0bcf764906690d9b

    SHA1

    4f1f2cc020dddc6d0108812624022e8e53dc65a6

    SHA256

    4f6464c1bd11617b3a72b98ea2c8762866c5b3da6fd037ac51eeacf95b8d58d7

    SHA512

    f87b322bebab41e6750efab17f662ed7771f6df9ddc93d681278e8c58844540c78ed302be6bf0f3f374e7bbfad16d5a851dfd448de1eeb5556776027ad6b43c1

  • C:\Windows\SysWOW64\omsecor.exe

    Filesize

    92KB

    MD5

    683c3665ae04e6c26c007d8238c0c8f4

    SHA1

    bb8f11f72de28c6eb5c05651f0691553d2c82d86

    SHA256

    f181c6913d75f4ea36abf33c2d50cbc74f37e6c72112df485184d0a210218e74

    SHA512

    c8fff0cd0343069fc6dad56921884013604f631bffaff278091cbfcce781f8ff581386aa10eba853a3a94820a94e84e8cd0f35a8c1030695fa2e70c62f2dd8bb

  • memory/216-19-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/216-20-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/2660-0-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/2660-6-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/4384-13-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/4384-17-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/4684-5-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/4684-7-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/4684-12-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB