neconyd | e6eb956806d831e3392fe2179f61df2bb975abb70f71e0708d48b7d831e808e7

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
virussign.com_088f8298a89ec92102cbd30370edf540.exe
Size 88KB
Sample240528-v71tqaeg49
SHA256 e6eb956806d831e3392fe2179f61df2bb975abb70f71e0708d48b7d831e808e7
MD5 088f8298a89ec92102cbd30370edf540
SHA1 674d34498839da3bb7f07520d1195d66746019f8
SHA512 77175d6a7cf1c453d80c96e3eee4128ba5bca255b4028c477d9cf7773ff2d4b024d09dbcdb604404a95ff391f04c1402e298aaca5860182d5bcf3e4e6aa0e541
SSDEEP 1536:4d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:IdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1676	omsecor.exe
2820	omsecor.exe
1980	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
756	virussign.com_088f8298a89ec92102cbd30370edf540.exe
756	virussign.com_088f8298a89ec92102cbd30370edf540.exe
1676	omsecor.exe
1676	omsecor.exe
2820	omsecor.exe
2820	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1676	756	virussign.com_088f8298a89ec92102cbd30370edf540.exe	28
PID 756 wrote to memory of 1676	756	virussign.com_088f8298a89ec92102cbd30370edf540.exe	28
PID 756 wrote to memory of 1676	756	virussign.com_088f8298a89ec92102cbd30370edf540.exe	28
PID 756 wrote to memory of 1676	756	virussign.com_088f8298a89ec92102cbd30370edf540.exe	28
PID 1676 wrote to memory of 2820	1676	omsecor.exe	32
PID 1676 wrote to memory of 2820	1676	omsecor.exe	32
PID 1676 wrote to memory of 2820	1676	omsecor.exe	32
PID 1676 wrote to memory of 2820	1676	omsecor.exe	32
PID 2820 wrote to memory of 1980	2820	omsecor.exe	33
PID 2820 wrote to memory of 1980	2820	omsecor.exe	33
PID 2820 wrote to memory of 1980	2820	omsecor.exe	33
PID 2820 wrote to memory of 1980	2820	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\virussign.com_088f8298a89ec92102cbd30370edf540.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_088f8298a89ec92102cbd30370edf540.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:756
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 a40c8265bde9821bcaac1303b3d2277912cd1452a321134e65aa7b489ed56c8b
MD5 6f13f5636f8480975bbd9cd7127a527e
SHA1 ad3fd75fbffcd22b213c7ca2d3889ca20de19b44
SHA512 001857c9dbd9bb96d7e4ba7a9e42a92de8348ca4006b15033ea6c949b7b28950cb4bfb6603a3817f3436fa44cac82d92d594b56b97dc790ef32e17eb7b62db43
SSDEEP 1536:sd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:UdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 e723be7f520b3673e83b0286e6ba4977e99916761120d75f83d91454aab14d4d
MD5 e32e80a25071628801b8a470e005373c
SHA1 9cfbb7814a4b8a5e2d77174a73d3be8dd1e5ac30
SHA512 2ff52bef4d7e89a9bf15cb55c54449ed928446ac6eafb710b2036287cb41f3ac5f8a1d2cea19ec31b028654dbfec3c913093e78d5a637f88bb01f294da281991
SSDEEP 1536:xd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:BdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 5c025d21e1fee570b64622660997b17127d0168ddac29139c4a7b5c94ca5cc8f
MD5 918b1b3bfcc671aed14786a828d92b36
SHA1 27824410e512d2814c2060c20a295da3a73ba90d
SHA512 769e1e370f7b37418f573a1e0edebe945f585dbeb8fe28ba655f8a797fe2f10d148da7d4890b2b6a10ee8e68b8f1e809cbc001cf33a511cec5f08945e4aacaef
SSDEEP 1536:8d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:EdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads