neconyd | bd1155b711071f1be18a677d7a4105c63ed19929e3e11ad3ee093120cb4bc906

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd1155b711071f1be18a677d7a4105c63ed19929e3e11ad3ee093120cb4bc906.exe
Size 92KB
Sample240524-c2z15aab71
SHA256 bd1155b711071f1be18a677d7a4105c63ed19929e3e11ad3ee093120cb4bc906
MD5 a561faddd50a3f4b342fec48b6131610
SHA1 4e5e42bd6b4baa4b91f13fd449eaed4516e39420
SHA512 489ef61d96098670375a94bac0abf766209315d45a277bee64339a546dc8fd12cf407fadc6cdfd23d63fa1dca25703df85b2a9a633b8e030dfc04fdba240c7df
SSDEEP 768:CMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:CbIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
1232	omsecor.exe
1480	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 1232	4504	bd1155b711071f1be18a677d7a4105c63ed19929e3e11ad3ee093120cb4bc906.exe	82
PID 4504 wrote to memory of 1232	4504	bd1155b711071f1be18a677d7a4105c63ed19929e3e11ad3ee093120cb4bc906.exe	82
PID 4504 wrote to memory of 1232	4504	bd1155b711071f1be18a677d7a4105c63ed19929e3e11ad3ee093120cb4bc906.exe	82
PID 1232 wrote to memory of 1480	1232	omsecor.exe	95
PID 1232 wrote to memory of 1480	1232	omsecor.exe	95
PID 1232 wrote to memory of 1480	1232	omsecor.exe	95

C:\Users\Admin\AppData\Local\Temp\bd1155b711071f1be18a677d7a4105c63ed19929e3e11ad3ee093120cb4bc906.exe
"C:\Users\Admin\AppData\Local\Temp\bd1155b711071f1be18a677d7a4105c63ed19929e3e11ad3ee093120cb4bc906.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:1480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 8f5fa24f8315ba65815157336aa96b68e8a4fe466008a3e2cd64404cdbf1057b
MD5 72c30eb34929a48e7bb33c1e5c04c70f
SHA1 2bd989cc9f0b2f5eb95f5af3b72c67a36d3bb2bb
SHA512 0ebe8925aec9544005f01f39974e21bfc1bd9c768eb1cc2264c3148429926c14e79ff1e7bf0c60132219550d7721af0a403fb42f12327f8e46ec5aeaa723578f
SSDEEP 768:mMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:mbIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 92KB
SHA256 a77a01e8237d9f76c1609aa55d3f36caa6291a3cf9ea84876183db83ffd23c2c
MD5 8fdb6d6df67db6c4d02e79468b3df32e
SHA1 189824084d5c1c91da1bea569fe94d86e4408485
SHA512 d78f6aa589e79d8be8bd26c523addc404abbe3fb216ede08a692e29037be78dfff13fafd74be1169730e903a7d8720399ef187c8fda868e13b5ec80d16044228
SSDEEP 768:gMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:gbIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1232-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1232-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1232-12-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1480-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1480-14-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4504-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4504-5-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads