neconyd | 9bccb2034b9a3fb750f186a47df5857072d0a19065a0706fcfa020824600854e

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9bccb2034b9a3fb750f186a47df5857072d0a19065a0706fcfa020824600854e.exe
Size 96KB
Sample240528-bl765aac76
SHA256 9bccb2034b9a3fb750f186a47df5857072d0a19065a0706fcfa020824600854e
MD5 7d239cae3426f32529ce5330b6571809
SHA1 779811f8258bde00a1e1cf47047791eb68efd4a7
SHA512 1fed931a826546957a1f1cb5feaef156f285c6cb7f924795e627402dd73d67924022935d5c63220467845f785f94808d388ac2d75235115a6ec5f1beff6f9809
SSDEEP 1536:knAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:kGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Detects executables built or packed with MPress PE compressor 9 IoCs

resource	yara_rule
behavioral2/memory/3588-0-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000b000000023385-10.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/900-11-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3588-17-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000a000000023435-32.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4332-33-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000b000000023385-41.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2012-43-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2012-51-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 6 IoCs

pid	Process
900	omsecor.exe
2336	omsecor.exe
4332	omsecor.exe
2728	omsecor.exe
2012	omsecor.exe
2936	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3588 set thread context of 1552	3588	9bccb2034b9a3fb750f186a47df5857072d0a19065a0706fcfa020824600854e.exe	82
PID 900 set thread context of 2336	900	omsecor.exe	87
PID 4332 set thread context of 2728	4332	omsecor.exe	103
PID 2012 set thread context of 2936	2012	omsecor.exe	107

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4708	3588	WerFault.exe	81
1972	900	WerFault.exe	84
2684	4332	WerFault.exe	102
2976	2012	WerFault.exe	105

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 1552	3588	9bccb2034b9a3fb750f186a47df5857072d0a19065a0706fcfa020824600854e.exe	82
PID 3588 wrote to memory of 1552	3588	9bccb2034b9a3fb750f186a47df5857072d0a19065a0706fcfa020824600854e.exe	82
PID 3588 wrote to memory of 1552	3588	9bccb2034b9a3fb750f186a47df5857072d0a19065a0706fcfa020824600854e.exe	82
PID 3588 wrote to memory of 1552	3588	9bccb2034b9a3fb750f186a47df5857072d0a19065a0706fcfa020824600854e.exe	82
PID 3588 wrote to memory of 1552	3588	9bccb2034b9a3fb750f186a47df5857072d0a19065a0706fcfa020824600854e.exe	82
PID 1552 wrote to memory of 900	1552	9bccb2034b9a3fb750f186a47df5857072d0a19065a0706fcfa020824600854e.exe	84
PID 1552 wrote to memory of 900	1552	9bccb2034b9a3fb750f186a47df5857072d0a19065a0706fcfa020824600854e.exe	84
PID 1552 wrote to memory of 900	1552	9bccb2034b9a3fb750f186a47df5857072d0a19065a0706fcfa020824600854e.exe	84
PID 900 wrote to memory of 2336	900	omsecor.exe	87
PID 900 wrote to memory of 2336	900	omsecor.exe	87
PID 900 wrote to memory of 2336	900	omsecor.exe	87
PID 900 wrote to memory of 2336	900	omsecor.exe	87
PID 900 wrote to memory of 2336	900	omsecor.exe	87
PID 2336 wrote to memory of 4332	2336	omsecor.exe	102
PID 2336 wrote to memory of 4332	2336	omsecor.exe	102
PID 2336 wrote to memory of 4332	2336	omsecor.exe	102
PID 4332 wrote to memory of 2728	4332	omsecor.exe	103
PID 4332 wrote to memory of 2728	4332	omsecor.exe	103
PID 4332 wrote to memory of 2728	4332	omsecor.exe	103
PID 4332 wrote to memory of 2728	4332	omsecor.exe	103
PID 4332 wrote to memory of 2728	4332	omsecor.exe	103
PID 2728 wrote to memory of 2012	2728	omsecor.exe	105
PID 2728 wrote to memory of 2012	2728	omsecor.exe	105
PID 2728 wrote to memory of 2012	2728	omsecor.exe	105
PID 2012 wrote to memory of 2936	2012	omsecor.exe	107
PID 2012 wrote to memory of 2936	2012	omsecor.exe	107
PID 2012 wrote to memory of 2936	2012	omsecor.exe	107
PID 2012 wrote to memory of 2936	2012	omsecor.exe	107
PID 2012 wrote to memory of 2936	2012	omsecor.exe	107

C:\Users\Admin\AppData\Local\Temp\9bccb2034b9a3fb750f186a47df5857072d0a19065a0706fcfa020824600854e.exe
"C:\Users\Admin\AppData\Local\Temp\9bccb2034b9a3fb750f186a47df5857072d0a19065a0706fcfa020824600854e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Users\Admin\AppData\Local\Temp\9bccb2034b9a3fb750f186a47df5857072d0a19065a0706fcfa020824600854e.exe
  C:\Users\Admin\AppData\Local\Temp\9bccb2034b9a3fb750f186a47df5857072d0a19065a0706fcfa020824600854e.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:900
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2336
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4332
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:2936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 256
        8⤵
        Program crash
        
        PID:2976
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 292
        6⤵
        Program crash
        
        PID:2684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 276
      4⤵
      Program crash
      PID:1972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 288
  2⤵
  - Program crash
  PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3588 -ip 3588
1⤵
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 900 -ip 900
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4332 -ip 4332
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2012 -ip 2012
1⤵
PID:4948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 c28f337a2e35bc4e5f9eaeb96510858b0fae81ac5da5b77758b7f3f4c89d041f
MD5 abe62148ffa7f11669a6143081f89bf3
SHA1 4e642271706bb7d2c957b0e3423d6166a9ebf2bb
SHA512 552fcf9f1c5e03d671f4b2862866b32dbe63a397c7b51bb82e5509ba76a5518139829ddd58f817bf74dc5b6a0ffc64b5bbf8cfc70709745405e4bcb41912ea1f
SSDEEP 1536:UnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:UGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 3e4d0ba84c2cbafe2d95468a5a92914d5c255223a02bf3d13a04fa46ac608eb4
MD5 2f50bb6e3af76cbc153fa3a98aa31e6c
SHA1 9343e5b76d2eb2591ea1ecabd897e8a8ac02dafb
SHA512 9e710f1f178806b279a162e6f70ca4a608efa2585b5f1d7452dedd0daec36dc63c7afc7c3aae86f7d110bee3775078c36e435ff0cbc341c1820b01eb71b8bd07
SSDEEP 1536:bnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:bGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 8e14530cfcd36b5d1536a435dc1e3d17a5deacc7660f4d815613d7a23fbd53ff
MD5 e2e5eff72bc0fe728fa2cb7b81b5bc0c
SHA1 d755f475ce61295c307d4654dcadcbec62bab179
SHA512 66682aeb5b11dc81e14ee6cc6b8b4a478ee6e77dec199f54afe69c43eab8c1af35dbaa16c10b4759f87b9a7b59622a3ff8331a62266e8f2faa94692d262dcf28
SSDEEP 1536:jnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:jGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/900-11-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1552-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1552-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1552-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1552-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2012-51-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2012-43-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2336-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2336-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2336-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2336-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2336-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2336-30-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2336-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2728-42-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2728-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2728-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2936-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2936-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2936-52-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2936-55-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3588-17-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3588-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4332-33-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads