neconyd | dda2b0afda672b80e3a22466ca49794d004fda677e2ea3e859282ea3e435b273

Analysis

max time kernel
149s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dda2b0afda672b80e3a22466ca49794d004fda677e2ea3e859282ea3e435b273.exe
Size 134KB
Sample240528-ederdsdf7w
SHA256 dda2b0afda672b80e3a22466ca49794d004fda677e2ea3e859282ea3e435b273
MD5 57f9218390e8916218028222eba4c06b
SHA1 c11f7f9a121a824800ecc43a2930cc7adac65082
SHA512 dc9973aa7c01ca5d74cbc5d71961b450c2416916b53c8347445a230cd6bcb843dedf22a8e45f5085a18131e3b318949b4dae9b7ff50b27f790b080d579465a2e
SSDEEP 1536:VDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:1iRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Detects executables built or packed with MPress PE compressor 11 IoCs

resource	yara_rule
behavioral2/memory/1048-0-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0008000000023257-6.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4748-8-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1048-15-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4748-16-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000300000000070d-28.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4468-33-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0008000000023257-43.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/5012-44-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4468-51-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/5012-52-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 6 IoCs

pid	Process
4748	omsecor.exe
404	omsecor.exe
4468	omsecor.exe
4092	omsecor.exe
5012	omsecor.exe
3916	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1048 set thread context of 4616	1048	dda2b0afda672b80e3a22466ca49794d004fda677e2ea3e859282ea3e435b273.exe	90
PID 4748 set thread context of 404	4748	omsecor.exe	94
PID 4468 set thread context of 4092	4468	omsecor.exe	108
PID 5012 set thread context of 3916	5012	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2432	1048	WerFault.exe	89
3712	4748	WerFault.exe	93
4672	4468	WerFault.exe	107
2044	5012	WerFault.exe	110

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 4616	1048	dda2b0afda672b80e3a22466ca49794d004fda677e2ea3e859282ea3e435b273.exe	90
PID 1048 wrote to memory of 4616	1048	dda2b0afda672b80e3a22466ca49794d004fda677e2ea3e859282ea3e435b273.exe	90
PID 1048 wrote to memory of 4616	1048	dda2b0afda672b80e3a22466ca49794d004fda677e2ea3e859282ea3e435b273.exe	90
PID 1048 wrote to memory of 4616	1048	dda2b0afda672b80e3a22466ca49794d004fda677e2ea3e859282ea3e435b273.exe	90
PID 1048 wrote to memory of 4616	1048	dda2b0afda672b80e3a22466ca49794d004fda677e2ea3e859282ea3e435b273.exe	90
PID 4616 wrote to memory of 4748	4616	dda2b0afda672b80e3a22466ca49794d004fda677e2ea3e859282ea3e435b273.exe	93
PID 4616 wrote to memory of 4748	4616	dda2b0afda672b80e3a22466ca49794d004fda677e2ea3e859282ea3e435b273.exe	93
PID 4616 wrote to memory of 4748	4616	dda2b0afda672b80e3a22466ca49794d004fda677e2ea3e859282ea3e435b273.exe	93
PID 4748 wrote to memory of 404	4748	omsecor.exe	94
PID 4748 wrote to memory of 404	4748	omsecor.exe	94
PID 4748 wrote to memory of 404	4748	omsecor.exe	94
PID 4748 wrote to memory of 404	4748	omsecor.exe	94
PID 4748 wrote to memory of 404	4748	omsecor.exe	94
PID 404 wrote to memory of 4468	404	omsecor.exe	107
PID 404 wrote to memory of 4468	404	omsecor.exe	107
PID 404 wrote to memory of 4468	404	omsecor.exe	107
PID 4468 wrote to memory of 4092	4468	omsecor.exe	108
PID 4468 wrote to memory of 4092	4468	omsecor.exe	108
PID 4468 wrote to memory of 4092	4468	omsecor.exe	108
PID 4468 wrote to memory of 4092	4468	omsecor.exe	108
PID 4468 wrote to memory of 4092	4468	omsecor.exe	108
PID 4092 wrote to memory of 5012	4092	omsecor.exe	110
PID 4092 wrote to memory of 5012	4092	omsecor.exe	110
PID 4092 wrote to memory of 5012	4092	omsecor.exe	110
PID 5012 wrote to memory of 3916	5012	omsecor.exe	112
PID 5012 wrote to memory of 3916	5012	omsecor.exe	112
PID 5012 wrote to memory of 3916	5012	omsecor.exe	112
PID 5012 wrote to memory of 3916	5012	omsecor.exe	112
PID 5012 wrote to memory of 3916	5012	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\dda2b0afda672b80e3a22466ca49794d004fda677e2ea3e859282ea3e435b273.exe
"C:\Users\Admin\AppData\Local\Temp\dda2b0afda672b80e3a22466ca49794d004fda677e2ea3e859282ea3e435b273.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\dda2b0afda672b80e3a22466ca49794d004fda677e2ea3e859282ea3e435b273.exe
  C:\Users\Admin\AppData\Local\Temp\dda2b0afda672b80e3a22466ca49794d004fda677e2ea3e859282ea3e435b273.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:404
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4468
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:3916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 256
        8⤵
        Program crash
        
        PID:2044
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 292
        6⤵
        Program crash
        
        PID:4672
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 300
      4⤵
      Program crash
      PID:3712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 288
  2⤵
  - Program crash
  PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 1048 -ip 1048
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4748 -ip 4748
1⤵
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3612 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4468 -ip 4468
1⤵
PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5012 -ip 5012
1⤵
PID:3944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 6bdab1b76dc8cf0a3e6e8ee05ad1344860990de711ce9786ca532b7c9493e86d
MD5 488ff94e8df70a0f2f7eb2932ad240ef
SHA1 6d4a7806f365260beb50095013f17ef5f8dfae9e
SHA512 4c4decfc62ca66ce68f1506ae51a895a1a2787495a60270760471ea21b9aca794d21954b6bf5c417f5aaf198ec20dffd8d0d2b9efe19282d334365a3bb19e4a4
SSDEEP 1536:TDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:fiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 a0f7c89f0f4f20ce0e68d94b1b740e216092071e3b1136da137967064ae3a0cc
MD5 27bb0404b7c92e938f3f781123a0ce76
SHA1 d8ce42bedbc90814bb23dd852c5d0ef06df76c44
SHA512 ccdd36d749d54e53861d12ca32dd4e1cdb0d0a4031c5009cf98aa0339200569222f1df73f73183c53fd90bc44c11b1658d91fc6b24ba9d6ac8bb2c30688898c0
SSDEEP 1536:1DfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:ViRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 134KB
SHA256 80dfe0ebcf11f79295c62c457e3cae5c3a4a594aaaf63c5a8f7c95126f961ad0
MD5 3daf966ae09fd50348e3566314371fa6
SHA1 35615137364da5599dc0f4124e55a4a53194f961
SHA512 e3cc522ae9e0a6126f8a41cd3231e7881195d94da19aa2a2f9e160b5d127fa995ea0aaef08dd177a1b45e80de9ebda461de62343932a59ef3c039123305aeed3
SSDEEP 1536:HDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:jiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/404-32-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/404-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/404-12-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/404-17-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/404-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/404-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1048-15-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1048-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3916-56-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3916-53-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3916-50-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3916-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4092-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4092-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4092-39-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4468-33-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4468-51-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4616-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4616-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4616-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4616-13-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4748-16-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4748-8-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5012-44-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5012-52-0x0000000000400000-0x0000000000424000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads