neconyd | a89d831a733c9cb0b00755ccc18c0fb687e4492d967e0bfadcc5998f12dcfa04

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a89d831a733c9cb0b00755ccc18c0fb687e4492d967e0bfadcc5998f12dcfa04.exe
Size 96KB
Sample240521-cxqlwsfa23
SHA256 a89d831a733c9cb0b00755ccc18c0fb687e4492d967e0bfadcc5998f12dcfa04
MD5 10cead850778732a49504e62596a27f8
SHA1 0233748c4b5b0ec7bded23cd452c676167f61876
SHA512 cb69b90ca74a7cea5d7dedf0f1116e2d05ebde3a4d1d2e1393c69202c0279a704f1c8db86b50a4ac80bd46f5416627d5c3bdc59c0ad92d80a8be897aa9a266d5
SSDEEP 1536:3nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:3Gs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Detects executables built or packed with MPress PE compressor 9 IoCs

resource	yara_rule
behavioral2/memory/2020-0-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x00060000000232a4-8.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/404-11-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2020-17-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0010000000023385-32.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3972-34-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x00060000000232a4-43.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4188-45-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4188-52-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 6 IoCs

pid	Process
404	omsecor.exe
5096	omsecor.exe
3972	omsecor.exe
1320	omsecor.exe
4188	omsecor.exe
2248	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2020 set thread context of 2264	2020	a89d831a733c9cb0b00755ccc18c0fb687e4492d967e0bfadcc5998f12dcfa04.exe	83
PID 404 set thread context of 5096	404	omsecor.exe	87
PID 3972 set thread context of 1320	3972	omsecor.exe	105
PID 4188 set thread context of 2248	4188	omsecor.exe	109

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4268	2020	WerFault.exe	82
3120	404	WerFault.exe	85
2508	3972	WerFault.exe	104
1188	4188	WerFault.exe	107

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2264	2020	a89d831a733c9cb0b00755ccc18c0fb687e4492d967e0bfadcc5998f12dcfa04.exe	83
PID 2020 wrote to memory of 2264	2020	a89d831a733c9cb0b00755ccc18c0fb687e4492d967e0bfadcc5998f12dcfa04.exe	83
PID 2020 wrote to memory of 2264	2020	a89d831a733c9cb0b00755ccc18c0fb687e4492d967e0bfadcc5998f12dcfa04.exe	83
PID 2020 wrote to memory of 2264	2020	a89d831a733c9cb0b00755ccc18c0fb687e4492d967e0bfadcc5998f12dcfa04.exe	83
PID 2020 wrote to memory of 2264	2020	a89d831a733c9cb0b00755ccc18c0fb687e4492d967e0bfadcc5998f12dcfa04.exe	83
PID 2264 wrote to memory of 404	2264	a89d831a733c9cb0b00755ccc18c0fb687e4492d967e0bfadcc5998f12dcfa04.exe	85
PID 2264 wrote to memory of 404	2264	a89d831a733c9cb0b00755ccc18c0fb687e4492d967e0bfadcc5998f12dcfa04.exe	85
PID 2264 wrote to memory of 404	2264	a89d831a733c9cb0b00755ccc18c0fb687e4492d967e0bfadcc5998f12dcfa04.exe	85
PID 404 wrote to memory of 5096	404	omsecor.exe	87
PID 404 wrote to memory of 5096	404	omsecor.exe	87
PID 404 wrote to memory of 5096	404	omsecor.exe	87
PID 404 wrote to memory of 5096	404	omsecor.exe	87
PID 404 wrote to memory of 5096	404	omsecor.exe	87
PID 5096 wrote to memory of 3972	5096	omsecor.exe	104
PID 5096 wrote to memory of 3972	5096	omsecor.exe	104
PID 5096 wrote to memory of 3972	5096	omsecor.exe	104
PID 3972 wrote to memory of 1320	3972	omsecor.exe	105
PID 3972 wrote to memory of 1320	3972	omsecor.exe	105
PID 3972 wrote to memory of 1320	3972	omsecor.exe	105
PID 3972 wrote to memory of 1320	3972	omsecor.exe	105
PID 3972 wrote to memory of 1320	3972	omsecor.exe	105
PID 1320 wrote to memory of 4188	1320	omsecor.exe	107
PID 1320 wrote to memory of 4188	1320	omsecor.exe	107
PID 1320 wrote to memory of 4188	1320	omsecor.exe	107
PID 4188 wrote to memory of 2248	4188	omsecor.exe	109
PID 4188 wrote to memory of 2248	4188	omsecor.exe	109
PID 4188 wrote to memory of 2248	4188	omsecor.exe	109
PID 4188 wrote to memory of 2248	4188	omsecor.exe	109
PID 4188 wrote to memory of 2248	4188	omsecor.exe	109

C:\Users\Admin\AppData\Local\Temp\a89d831a733c9cb0b00755ccc18c0fb687e4492d967e0bfadcc5998f12dcfa04.exe
"C:\Users\Admin\AppData\Local\Temp\a89d831a733c9cb0b00755ccc18c0fb687e4492d967e0bfadcc5998f12dcfa04.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\a89d831a733c9cb0b00755ccc18c0fb687e4492d967e0bfadcc5998f12dcfa04.exe
  C:\Users\Admin\AppData\Local\Temp\a89d831a733c9cb0b00755ccc18c0fb687e4492d967e0bfadcc5998f12dcfa04.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:404
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:5096
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3972
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1320
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:2248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 256
        8⤵
        Program crash
        
        PID:1188
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 292
        6⤵
        Program crash
        
        PID:2508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 288
      4⤵
      Program crash
      PID:3120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 292
  2⤵
  - Program crash
  PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2020 -ip 2020
1⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 404 -ip 404
1⤵
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3972 -ip 3972
1⤵
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4188 -ip 4188
1⤵
PID:4888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 fb25e21052a8850ce6049499613cbf6280a354665615d1844596beb687c24457
MD5 b64e373c206a9d91fd905c349debe3e5
SHA1 cd39c1a40cc95a1caa987d70d427d12176a6405a
SHA512 ad5cffd121ee7064973134c9c0641b25f8044f9b3d789101553bc968f6de978c006ee5912f047070ac843bb3bac76f0bb7bb288f61878609de1fc369a99d2275
SSDEEP 1536:inAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:iGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 eaa2384add1d129045612b383b67aebf486192d7f6a09a9630779038f414097b
MD5 1cbda766f5a296c2c95eac51159cdd26
SHA1 07c6dcd230a8e38064ca348c6eaa381d3e5cddf9
SHA512 3f84afb86ac478bf1bb97ebc57176e3e6cc90718f3e1957fdc70557673abbbd9035f3d357a4e9c4f926de794ffa935da34c88d7f2212ac080ed37e4c7e0fd767
SSDEEP 1536:DnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:DGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 2e1c4dcd2469a6dacee59ea9b387d0573935de3be9dc619a5b7e44373995c032
MD5 c5082b0aff87a8a0d03df299264585b9
SHA1 4904750bb321241de61ec6d5687d7787bd941bb0
SHA512 cf59d5a8ec44978ce387d9f5d780fc45dc78b1ad77f96b864dcd6712132887177a14e46eb152e368c4f6396bbe6dca7019f33f9001fd643638eb0db62937409b
SSDEEP 1536:fnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:fGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-11-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1320-40-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1320-38-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1320-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2020-17-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2020-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2248-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2248-50-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2248-53-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2248-56-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2264-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2264-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2264-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2264-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3972-34-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4188-45-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4188-52-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5096-33-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5096-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5096-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5096-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5096-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5096-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5096-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads