neconyd | 7679fd740b29f084f52ce64669fe9720bde66de53d24b5e7770dee890f16e7cf

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 23:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7679fd740b29f084f52ce64669fe9720bde66de53d24b5e7770dee890f16e7cf.exe
Size 88KB
Sample240527-3szbcaee5w
SHA256 7679fd740b29f084f52ce64669fe9720bde66de53d24b5e7770dee890f16e7cf
MD5 554d54f28a7365ce7a12f3c84e6c9806
SHA1 d6e959eb81a7410e04ad8492791d56cb01ec534e
SHA512 15497a3763f24e9e21d2397107fada101863354b360c0ece91f7fc9bd1a7a8df57e7dff151b6413dc3f9e138348ac23d99ebe47707e480a5f22bb756665eea50
SSDEEP 1536:4d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:IdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4028	omsecor.exe
1436	omsecor.exe
4772	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 4028	1984	7679fd740b29f084f52ce64669fe9720bde66de53d24b5e7770dee890f16e7cf.exe	83
PID 1984 wrote to memory of 4028	1984	7679fd740b29f084f52ce64669fe9720bde66de53d24b5e7770dee890f16e7cf.exe	83
PID 1984 wrote to memory of 4028	1984	7679fd740b29f084f52ce64669fe9720bde66de53d24b5e7770dee890f16e7cf.exe	83
PID 4028 wrote to memory of 1436	4028	omsecor.exe	100
PID 4028 wrote to memory of 1436	4028	omsecor.exe	100
PID 4028 wrote to memory of 1436	4028	omsecor.exe	100
PID 1436 wrote to memory of 4772	1436	omsecor.exe	101
PID 1436 wrote to memory of 4772	1436	omsecor.exe	101
PID 1436 wrote to memory of 4772	1436	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\7679fd740b29f084f52ce64669fe9720bde66de53d24b5e7770dee890f16e7cf.exe
"C:\Users\Admin\AppData\Local\Temp\7679fd740b29f084f52ce64669fe9720bde66de53d24b5e7770dee890f16e7cf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 1e9cea6e585e00065c4a8057a665563173bdb94e41671d4ae7753ac8e3d424b5
MD5 17aa0ab184963651cde489fd0cb64694
SHA1 b0b16ba4330e3a8bfbf1ce2a01db885042313e97
SHA512 b12c2f88398a94a73ba2c2138b8918d663c2cc7cbfe7d1468e850db8d55a180a9eb08a5d55b5ef417890ce38345d31b950047031186e44113ddbf6152e024b23
SSDEEP 1536:od9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:YdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 f9d0a2e4130fbccfd019a0ef8202071628a6442b138a09492dd1dca6cac76b65
MD5 673bcfa19e61d38803f40f75dac57f26
SHA1 0db1596bcd7afa4a56e95ef1cb98e3bb9df02be2
SHA512 db0320104d414a57365d5b7be4681511b0c46ea26553564dea99e670d6b7cd3ad2d64926067257583aee95cb56bd6f7f4555c7f63b2e8d52ba9f69e1d1214798
SSDEEP 1536:Ed9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:8dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 fb0bad9a0d32ae40f383f5cf0da810d34dba9a4465f2515d70fa7e53207b9ccd
MD5 dc150aa6300945338075d94ac0bdad96
SHA1 3c50284b41aaba0b8cb1420d45cd4aa9c4619958
SHA512 40794b536b349ea774094fdcffbc1cfcea18460575fa27bfee1969ec5f0434a727ee5c4c09c51b94229f19e6846389a6346b04fe10ec59657564052f9559ea11
SSDEEP 1536:Ed9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:8dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads