Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 04:49

General

  • Target

    fb499ec5c2e95098bb357a8709af4f1e7286225170151ee37ebdfc09159ced88.exe

  • Size

    92KB

  • MD5

    aa765cd288e63767f2320948ff0cbd0e

  • SHA1

    4e74675a1ec0b9f240266c0b35c8d291f788d94b

  • SHA256

    fb499ec5c2e95098bb357a8709af4f1e7286225170151ee37ebdfc09159ced88

  • SHA512

    de98ebe490af7623e6d4f4abf4d03b56647751be8d958d6b5f64fdeb6f7496f6318d81e37d4c9b859d3226a1675f4cecbe16a87796ce69f8d7e7cc5ffb47ff2d

  • SSDEEP

    768:CMEIYFGvoErlLFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:CbIYYvoE1FKF6N4yS+AQmZTl/5

Score
10/10

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

  • Neconyd

    Neconyd is a trojan written in C++.

  • Executes dropped EXE 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb499ec5c2e95098bb357a8709af4f1e7286225170151ee37ebdfc09159ced88.exe
    "C:\Users\Admin\AppData\Local\Temp\fb499ec5c2e95098bb357a8709af4f1e7286225170151ee37ebdfc09159ced88.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:5040
      • C:\Windows\SysWOW64\omsecor.exe
        C:\Windows\System32\omsecor.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3284
        • C:\Users\Admin\AppData\Roaming\omsecor.exe
          C:\Users\Admin\AppData\Roaming\omsecor.exe
          4⤵
          • Executes dropped EXE
          PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    92KB

    MD5

    587fbff0aceedaad6b6aa8941b9599ca

    SHA1

    69854975718f295b07bc639079ed807248ed73de

    SHA256

    29fb9aab5cc62a9b4c943e841dc9ddf4910f2e1419466825f0e74b8cc9589cd5

    SHA512

    5935a5f0026cfbef4507bf4e9aee11a290ea63a012e7e8993d9a2a8ed5a14d68e1534abfdf8ae9da95ed58891a82c35d7449d77302639b6360cfe3fab91e4a85

  • C:\Users\Admin\AppData\Roaming\omsecor.exe

    Filesize

    92KB

    MD5

    44d3d34054a04ecd2cba9aa7220cb21e

    SHA1

    8c02b4a7302c883f2e42551e78ca13588c383cd8

    SHA256

    a1166d7ece5945db0a559a5f61b4320f17a066a88efcf877362ee2277d4707cd

    SHA512

    45f7671d0cb17c4ef6a983e8bf443d413057d3c47aaa08e5d37043bc0c8ed28d394af8b920f91c409145655a0cdeb1be6df4952fa58b88cfb7b7e65603d6e6c8

  • C:\Windows\SysWOW64\omsecor.exe

    Filesize

    92KB

    MD5

    fe14603f28fe438073656d794e1e6622

    SHA1

    3e8d96174a6dfdd82c73870729a325b30c29bba7

    SHA256

    be82b0c1c2a45865e0f9bed918b91431edf4be135e4079ed641e92ff28658fe9

    SHA512

    0b0e6978c01066899c8781c7f02a9d961069a8eddfb04b9213e1b3f1ebdc7ea9fd8b988ae2258e9f824c9af024d336708fd051277c225efa8f52397a9c6e2f9f

  • memory/900-19-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/900-20-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/2216-0-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/2216-5-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/3284-13-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/3284-16-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/5040-6-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/5040-7-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/5040-12-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB