neconyd | fb499ec5c2e95098bb357a8709af4f1e7286225170151ee37ebdfc09159ced88

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fb499ec5c2e95098bb357a8709af4f1e7286225170151ee37ebdfc09159ced88.exe
Size 92KB
Sample240520-ff57sscd64
SHA256 fb499ec5c2e95098bb357a8709af4f1e7286225170151ee37ebdfc09159ced88
MD5 aa765cd288e63767f2320948ff0cbd0e
SHA1 4e74675a1ec0b9f240266c0b35c8d291f788d94b
SHA512 de98ebe490af7623e6d4f4abf4d03b56647751be8d958d6b5f64fdeb6f7496f6318d81e37d4c9b859d3226a1675f4cecbe16a87796ce69f8d7e7cc5ffb47ff2d
SSDEEP 768:CMEIYFGvoErlLFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:CbIYYvoE1FKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
5040	omsecor.exe
3284	omsecor.exe
900	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 5040	2216	fb499ec5c2e95098bb357a8709af4f1e7286225170151ee37ebdfc09159ced88.exe	82
PID 2216 wrote to memory of 5040	2216	fb499ec5c2e95098bb357a8709af4f1e7286225170151ee37ebdfc09159ced88.exe	82
PID 2216 wrote to memory of 5040	2216	fb499ec5c2e95098bb357a8709af4f1e7286225170151ee37ebdfc09159ced88.exe	82
PID 5040 wrote to memory of 3284	5040	omsecor.exe	99
PID 5040 wrote to memory of 3284	5040	omsecor.exe	99
PID 5040 wrote to memory of 3284	5040	omsecor.exe	99
PID 3284 wrote to memory of 900	3284	omsecor.exe	100
PID 3284 wrote to memory of 900	3284	omsecor.exe	100
PID 3284 wrote to memory of 900	3284	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\fb499ec5c2e95098bb357a8709af4f1e7286225170151ee37ebdfc09159ced88.exe
"C:\Users\Admin\AppData\Local\Temp\fb499ec5c2e95098bb357a8709af4f1e7286225170151ee37ebdfc09159ced88.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 29fb9aab5cc62a9b4c943e841dc9ddf4910f2e1419466825f0e74b8cc9589cd5
MD5 587fbff0aceedaad6b6aa8941b9599ca
SHA1 69854975718f295b07bc639079ed807248ed73de
SHA512 5935a5f0026cfbef4507bf4e9aee11a290ea63a012e7e8993d9a2a8ed5a14d68e1534abfdf8ae9da95ed58891a82c35d7449d77302639b6360cfe3fab91e4a85
SSDEEP 768:ZMEIYFGvoErlLFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:ZbIYYvoE1FKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 a1166d7ece5945db0a559a5f61b4320f17a066a88efcf877362ee2277d4707cd
MD5 44d3d34054a04ecd2cba9aa7220cb21e
SHA1 8c02b4a7302c883f2e42551e78ca13588c383cd8
SHA512 45f7671d0cb17c4ef6a983e8bf443d413057d3c47aaa08e5d37043bc0c8ed28d394af8b920f91c409145655a0cdeb1be6df4952fa58b88cfb7b7e65603d6e6c8
SSDEEP 768:+MEIYFGvoErlLFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:+bIYYvoE1FKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 92KB
SHA256 be82b0c1c2a45865e0f9bed918b91431edf4be135e4079ed641e92ff28658fe9
MD5 fe14603f28fe438073656d794e1e6622
SHA1 3e8d96174a6dfdd82c73870729a325b30c29bba7
SHA512 0b0e6978c01066899c8781c7f02a9d961069a8eddfb04b9213e1b3f1ebdc7ea9fd8b988ae2258e9f824c9af024d336708fd051277c225efa8f52397a9c6e2f9f
SSDEEP 768:9MEIYFGvoErlLFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:9bIYYvoE1FKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/900-19-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/900-20-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2216-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2216-5-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3284-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3284-16-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5040-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5040-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5040-12-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads