neconyd | c70d48ce22082e6deab61e014a815526bf6971089e9cfcdcee767f4ee0659011

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c70d48ce22082e6deab61e014a815526bf6971089e9cfcdcee767f4ee0659011.exe
Size 92KB
Sample240528-dfnlmsdd55
SHA256 c70d48ce22082e6deab61e014a815526bf6971089e9cfcdcee767f4ee0659011
MD5 9e8839d44c63f8c76d8797b3a1917c23
SHA1 1707b1f35cbed4e750efc63af5d72fcf584fbc8e
SHA512 eda8ee65a70c4591ab8f5e4e100bdab05727aa5e5d2d1051b68e5c276d139a1e85bf6d594247f348cfd55a7706c95859a9ef843d2055fc4365ed26936c1ae13c
SSDEEP 768:wMEIYFGvoErlLFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:wbIYYvoE1FKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4360	omsecor.exe
4412	omsecor.exe
4580	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 4360	1748	c70d48ce22082e6deab61e014a815526bf6971089e9cfcdcee767f4ee0659011.exe	84
PID 1748 wrote to memory of 4360	1748	c70d48ce22082e6deab61e014a815526bf6971089e9cfcdcee767f4ee0659011.exe	84
PID 1748 wrote to memory of 4360	1748	c70d48ce22082e6deab61e014a815526bf6971089e9cfcdcee767f4ee0659011.exe	84
PID 4360 wrote to memory of 4412	4360	omsecor.exe	95
PID 4360 wrote to memory of 4412	4360	omsecor.exe	95
PID 4360 wrote to memory of 4412	4360	omsecor.exe	95
PID 4412 wrote to memory of 4580	4412	omsecor.exe	96
PID 4412 wrote to memory of 4580	4412	omsecor.exe	96
PID 4412 wrote to memory of 4580	4412	omsecor.exe	96

C:\Users\Admin\AppData\Local\Temp\c70d48ce22082e6deab61e014a815526bf6971089e9cfcdcee767f4ee0659011.exe
"C:\Users\Admin\AppData\Local\Temp\c70d48ce22082e6deab61e014a815526bf6971089e9cfcdcee767f4ee0659011.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 7b6eb613f345da5b2594e389faf7181b7f58429746c48303fb83baf6ef7a749e
MD5 6daab6a8a0deb00c4c2e9a6794436be8
SHA1 da5d1cb9238821e3b2f2de141d6eed12ba8d9f2e
SHA512 a9f6a19a026519d5216937a432d0cf6ef0b44fd88a87b2f68cce87f7f0e222925e5e1ea18a75da719541e4f7f73beec29be485c2a001b5e99944f2bc3acf8cb6
SSDEEP 768:ZMEIYFGvoErlLFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:ZbIYYvoE1FKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 0da2f27bccefd6685d344970abe0b4be8d050b6914580dcc9854335433fb7d05
MD5 2c48f6d313ff2d05a1b68a590f094b83
SHA1 ba91285eec2e47e59ee4e1bd94cebc1f53b44b04
SHA512 116e84f75737b1c2c6cc4b6c016c7ded88fa1d7c559b8924ab509cebaf1f809ea95de651f357d0061355ea4dd85fa5bd194089d4409175d1e84a45cb35b6518d
SSDEEP 768:4MEIYFGvoErlLFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:4bIYYvoE1FKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 92KB
SHA256 b4ac32ee0accd1af9a1f6038234d1a9fe188d0140d40308839ed800b68fc8d4d
MD5 400e0336b8cf8e54a1ae1d71b2b618df
SHA1 bfc0ff314397e7b707d7db117d37a5765f775e01
SHA512 42f3e599dea9c688bb123d9df34f5448778335f286c21b2a1a63bc609e70b3d0501ca4fc50e8269d3c516a42bae107f5e434bb695ac94968873db2bbe0a56df6
SSDEEP 768:NMEIYFGvoErlLFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:NbIYYvoE1FKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1748-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1748-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4360-5-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4360-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4360-11-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4412-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4412-16-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4580-18-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4580-20-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads