neconyd | b4f7562f3e3a145a85c1b97a08e06468dae73836a52a164ff336225b664f2ba1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 05:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4f7562f3e3a145a85c1b97a08e06468dae73836a52a164ff336225b664f2ba1.exe
Size 65KB
Sample240522-gh559aea62
SHA256 b4f7562f3e3a145a85c1b97a08e06468dae73836a52a164ff336225b664f2ba1
MD5 0486239d3c8669b047b35065cd548f9c
SHA1 2cc8e608569d3025d6fef8fabd067aaf9f97d01a
SHA512 df203ae9057c067f586fc1e23a9d2732c6222d247034992e7e80528babeedcd8d60c9ec228683a53e9f419de52572426228d5295488c352ca7146000eaf0feb8
SSDEEP 1536:0d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZcl/5:MdseIO+EZEyFjEOFqTiQmOl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1192	omsecor.exe
4868	omsecor.exe
1020	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1192	2112	b4f7562f3e3a145a85c1b97a08e06468dae73836a52a164ff336225b664f2ba1.exe	83
PID 2112 wrote to memory of 1192	2112	b4f7562f3e3a145a85c1b97a08e06468dae73836a52a164ff336225b664f2ba1.exe	83
PID 2112 wrote to memory of 1192	2112	b4f7562f3e3a145a85c1b97a08e06468dae73836a52a164ff336225b664f2ba1.exe	83
PID 1192 wrote to memory of 4868	1192	omsecor.exe	100
PID 1192 wrote to memory of 4868	1192	omsecor.exe	100
PID 1192 wrote to memory of 4868	1192	omsecor.exe	100
PID 4868 wrote to memory of 1020	4868	omsecor.exe	101
PID 4868 wrote to memory of 1020	4868	omsecor.exe	101
PID 4868 wrote to memory of 1020	4868	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\b4f7562f3e3a145a85c1b97a08e06468dae73836a52a164ff336225b664f2ba1.exe
"C:\Users\Admin\AppData\Local\Temp\b4f7562f3e3a145a85c1b97a08e06468dae73836a52a164ff336225b664f2ba1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 65KB
SHA256 8a446eace4764bb80c29e96a2458442bb634fb56b821b0790de5c4d02e513890
MD5 f7b3b423ae543a9164a3ff750c6f9e00
SHA1 ef5712768da9eb202ad009effeeb365e77498fee
SHA512 42a79b02b8bed9000050016e24c7335fbf6a8d7d42de09ed3d8f6cbff137e7d1c7c65b31f09f4e49a0a53a204cc2e4a4cf77962e1c69d6126c5c606618300c08
SSDEEP 1536:cd9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZcl/5:kdseIO+EZEyFjEOFqTiQmOl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 65KB
SHA256 75ebf21fa18123c6af3a366e122845869968168676216bdfacd51d23f9681cf1
MD5 3f422de3490b060a475f1a205584be74
SHA1 7e1beb19de266dda0235781d298c1317bc545568
SHA512 7f4a216cf9edecf3587ff9a941dd09179efbb20f0c158ded768cb3a1364ddec3f38b5c42b4c62d96c5fdc041a81963428ce45bcd39cedba9e1c6832b5fecc427
SSDEEP 1536:Ed9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZcl/5:8dseIO+EZEyFjEOFqTiQmOl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 65KB
SHA256 a7cdebae9e63273820c58e808e8cac846c7325fa12d2f56b67ca51cc5de7f398
MD5 7a9d672f7473170668db837615d30b86
SHA1 3aa02ec6d0d221ecaa968ca3adec6d1cb82507e9
SHA512 7ab2d3042ce7dfb40178c6872cff24f920f5bf25ef70516d4970c34fb47f6198499a581840790e14445c6b082f05c04da8f71ff099ac578ea0ec4060fe70aa08
SSDEEP 1536:0d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZcl/5:MdseIO+EZEyFjEOFqTiQmOl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1020-18-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1020-20-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1192-6-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1192-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1192-12-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2112-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2112-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4868-14-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4868-17-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads