neconyd | 619c5f70e305ea4f00b249bc3f3b5726b4aca58cf0b9a0eaf84b1492ebbbcbd5

Analysis

max time kernel
145s
max time network
148s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 23:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
619c5f70e305ea4f00b249bc3f3b5726b4aca58cf0b9a0eaf84b1492ebbbcbd5.exe
Size 72KB
Sample240521-3wrexaeb44
SHA256 619c5f70e305ea4f00b249bc3f3b5726b4aca58cf0b9a0eaf84b1492ebbbcbd5
MD5 cacfc7acb7a9648a1f04481c72c3063f
SHA1 a42c64da838dbd51665b485a5997f94754a06d8e
SHA512 92534364ad07711224b8a7ba6d5b55cc31e1af1d9a8f1633a66cfec17dff28682869fbb8e1844ed5ad8cb22332189596bb01e4e24bcc455ff57c924442e067b2
SSDEEP 1536:qd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:qdseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2232	omsecor.exe
1652	omsecor.exe
1780	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2876	619c5f70e305ea4f00b249bc3f3b5726b4aca58cf0b9a0eaf84b1492ebbbcbd5.exe
2876	619c5f70e305ea4f00b249bc3f3b5726b4aca58cf0b9a0eaf84b1492ebbbcbd5.exe
2232	omsecor.exe
2232	omsecor.exe
1652	omsecor.exe
1652	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2232	2876	619c5f70e305ea4f00b249bc3f3b5726b4aca58cf0b9a0eaf84b1492ebbbcbd5.exe	28
PID 2876 wrote to memory of 2232	2876	619c5f70e305ea4f00b249bc3f3b5726b4aca58cf0b9a0eaf84b1492ebbbcbd5.exe	28
PID 2876 wrote to memory of 2232	2876	619c5f70e305ea4f00b249bc3f3b5726b4aca58cf0b9a0eaf84b1492ebbbcbd5.exe	28
PID 2876 wrote to memory of 2232	2876	619c5f70e305ea4f00b249bc3f3b5726b4aca58cf0b9a0eaf84b1492ebbbcbd5.exe	28
PID 2232 wrote to memory of 1652	2232	omsecor.exe	32
PID 2232 wrote to memory of 1652	2232	omsecor.exe	32
PID 2232 wrote to memory of 1652	2232	omsecor.exe	32
PID 2232 wrote to memory of 1652	2232	omsecor.exe	32
PID 1652 wrote to memory of 1780	1652	omsecor.exe	33
PID 1652 wrote to memory of 1780	1652	omsecor.exe	33
PID 1652 wrote to memory of 1780	1652	omsecor.exe	33
PID 1652 wrote to memory of 1780	1652	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\619c5f70e305ea4f00b249bc3f3b5726b4aca58cf0b9a0eaf84b1492ebbbcbd5.exe
"C:\Users\Admin\AppData\Local\Temp\619c5f70e305ea4f00b249bc3f3b5726b4aca58cf0b9a0eaf84b1492ebbbcbd5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 77ec1a4a59a4f795ef76377c79730089927dcda5dc1fa2cbc9d6f3a12ae87205
MD5 61341743660419ceb38e456ae0d31992
SHA1 637df5023c8b0bab0e43148d8acff4dd36adca24
SHA512 7afcff43e897d8d4fa88bf8045327923fc857fb142dd0f7d4a0224fcd1ef804538c4cd70828e4a6413af3c14cf554bcbdbc8dfc78e770e4172e4041356af5e1c
SSDEEP 1536:yd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:CdseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 76e8dbd4d6506c98722ceb327bd91ccbb85344a10fd9c982558d28c7d480b553
MD5 78a485d1ab9ac42600e20ead8c129e96
SHA1 ec9a278f36aed8106e6354d3e172010152c5283a
SHA512 d91fb1e6b00c5b0e8ae1cc34c027e5da9df07925b3454c57bbe565132481739e3827b97bce743fc606c28fa6521b5e05b6b16553a7fbd6526ab22c9b34184e2e
SSDEEP 1536:5d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:ZdseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 72KB
SHA256 a972745c074cb8c3fd64a8e6680952b9b57f3ec6a72448cfa3bc598c76ca4c43
MD5 6aacef6b0da2fd3c827bc3b4abc03f07
SHA1 5e149d939596ec149137e479d1d89fa950dfb3cd
SHA512 c546060cf5c3b4db815fcba540a5090647812205335c58c732ea150fd89cafb9c44c88f6d0b3df09220ed7fbdb4e78e815886617ecbf5b6637e57595351da925
SSDEEP 1536:ld9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:NdseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads