neconyd | aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290

Analysis

max time kernel
122s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290.exe
Size 89KB
Sample240529-baltrabf3x
SHA256 aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290
MD5 6231301a178b14ac3afd6a50a1fbfc28
SHA1 3123b59dd0332534a79d43a5e0c788bda30811fb
SHA512 fd9750ff5e63fa118ce1325e75a0e0069708072fd98463920c9be4a51d7d5414a53af3583dc1f351cf3c0fd4733bc466c1d51b220838b20b7d44dbdd6ed32cf4
SSDEEP 768:4MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:4bIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2136	omsecor.exe
2424	omsecor.exe
2696	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1336	aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290.exe
1336	aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290.exe
2136	omsecor.exe
2136	omsecor.exe
2424	omsecor.exe
2424	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2136	1336	aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290.exe	28
PID 1336 wrote to memory of 2136	1336	aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290.exe	28
PID 1336 wrote to memory of 2136	1336	aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290.exe	28
PID 1336 wrote to memory of 2136	1336	aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290.exe	28
PID 2136 wrote to memory of 2424	2136	omsecor.exe	32
PID 2136 wrote to memory of 2424	2136	omsecor.exe	32
PID 2136 wrote to memory of 2424	2136	omsecor.exe	32
PID 2136 wrote to memory of 2424	2136	omsecor.exe	32
PID 2424 wrote to memory of 2696	2424	omsecor.exe	33
PID 2424 wrote to memory of 2696	2424	omsecor.exe	33
PID 2424 wrote to memory of 2696	2424	omsecor.exe	33
PID 2424 wrote to memory of 2696	2424	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290.exe
"C:\Users\Admin\AppData\Local\Temp\aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 89KB
SHA256 0519ac266b419cb71c14a82eeaf8a7484db418b6494043daeeecf7eca62411a6
MD5 80e33ba6c013dd7156ec0cf906778391
SHA1 f91683983348c496fe21872246e1b61d2b20751d
SHA512 665516bb981d1da9ffaa766791f83cb4eb3f06eee23959cae2739f8b1f98e5f8f6463168a1e9866b5d4aa2c230f8532e897991dafaf99d15cd8eb9508759f2c4
SSDEEP 768:nMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:nbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 89KB
SHA256 2b273866da0679767cf3d991da7e244614b908c764a575f6c365b2c8f555f1a3
MD5 d2be3598d5756f6ef66cca5cf475e5fa
SHA1 c49df03a8115b2f6638baa23e37c2b1ad291ecc9
SHA512 e006839ce8881ec3fd011ec4248ab826e2430f64fd045675907aadc8f5f1e98482c4579de448c30c9949efed28525b7402e1eac0413d2b468a0f39dc9d183622
SSDEEP 768:uMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:ubIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 89KB
SHA256 1111a041e07c7f36f7904d6ce374009c5952a87d0f30a735f6bf13ba34eb1175
MD5 03610c352027a18d267ca7d9d1976831
SHA1 46b342a9d28ccd882760a0a5d424ac7c967d1163
SHA512 a772cb1329baf602f65c2cbe5a6efbb8a41f1b3d4059a62cb5a590c7dbfbd22fbc76684c130e3ddbf714898c2716e28410948af309a789e94bd9ef2f9e17580b
SSDEEP 768:3MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:3bIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads