neconyd | d0d478bde7cc5ca0e64f909de0a5b06ebca1d852a2ca39e4fd463a89cd80656f

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d0d478bde7cc5ca0e64f909de0a5b06ebca1d852a2ca39e4fd463a89cd80656f.exe
Size 76KB
Sample240528-dtekwscg5v
SHA256 d0d478bde7cc5ca0e64f909de0a5b06ebca1d852a2ca39e4fd463a89cd80656f
MD5 800492c0c630bfee52ddc6710e365380
SHA1 83bbde0757d35a5b996398cfa7f3aeeda89cead7
SHA512 95f863bf56fded5624e13de9dd49468fe74bd1b3cd8456352c441c5d19da0b149af24bdbfba5afb16bda65a3e482fa09911577af0cd504a8f990b8ac57c8a925
SSDEEP 1536:ad9dseIOcE93dIvYvZDyF4EEOF6N4yS+AQmZTl/5R11:6dseIOKEZDyFjEOFqTiQm5l/5R11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
1736	omsecor.exe
4940	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 1736	2576	d0d478bde7cc5ca0e64f909de0a5b06ebca1d852a2ca39e4fd463a89cd80656f.exe	81
PID 2576 wrote to memory of 1736	2576	d0d478bde7cc5ca0e64f909de0a5b06ebca1d852a2ca39e4fd463a89cd80656f.exe	81
PID 2576 wrote to memory of 1736	2576	d0d478bde7cc5ca0e64f909de0a5b06ebca1d852a2ca39e4fd463a89cd80656f.exe	81
PID 1736 wrote to memory of 4940	1736	omsecor.exe	90
PID 1736 wrote to memory of 4940	1736	omsecor.exe	90
PID 1736 wrote to memory of 4940	1736	omsecor.exe	90

C:\Users\Admin\AppData\Local\Temp\d0d478bde7cc5ca0e64f909de0a5b06ebca1d852a2ca39e4fd463a89cd80656f.exe
"C:\Users\Admin\AppData\Local\Temp\d0d478bde7cc5ca0e64f909de0a5b06ebca1d852a2ca39e4fd463a89cd80656f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 f1f3e7a32b55f8d13686a32d14456e11750998601da447e9e0e2418c39697611
MD5 c4b514e03dd58fb9f49ddcb092b0a744
SHA1 c83155c60332282eb447d312ce0fee3a543151a3
SHA512 1abf6cabac6e708f47c4abc5ff4b3bc2c43756aa2637d375f6925f6c26418bcf77ded051ec6e774b6950ad97c73165238eaed5f09b3a90164a3697628300c22f
SSDEEP 1536:id9dseIOcE93dIvYvZDyF4EEOF6N4yS+AQmZTl/5R11:SdseIOKEZDyFjEOFqTiQm5l/5R11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 622fb3ea0cf224c5081763a2dabb9513ef32067fe5abcec4a7ee9b34ee1012dc
MD5 20e77ae314cab9c619af2a79d81c3c4e
SHA1 b86279bee7b4e805a4c21da96d6e6edd3285f421
SHA512 6203c958fc372c23ca28d1a42438a80f4dbaf12ca8918200201ea5ad50f97eb235b1a88b38ff91c1dd4d1636a45db57c6eb35ce37c44f3fa2098f9c272c67d13
SSDEEP 1536:6d9dseIOcE93dIvYvZDyF4EEOF6N4yS+AQmZTl/5R11:adseIOKEZDyFjEOFqTiQm5l/5R11
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1736-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1736-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1736-12-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2576-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2576-4-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4940-13-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4940-14-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads