neconyd | aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290.exe
Size 89KB
Sample240529-baltrabf3x
SHA256 aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290
MD5 6231301a178b14ac3afd6a50a1fbfc28
SHA1 3123b59dd0332534a79d43a5e0c788bda30811fb
SHA512 fd9750ff5e63fa118ce1325e75a0e0069708072fd98463920c9be4a51d7d5414a53af3583dc1f351cf3c0fd4733bc466c1d51b220838b20b7d44dbdd6ed32cf4
SSDEEP 768:4MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:4bIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1544	omsecor.exe
3968	omsecor.exe
1804	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1544	940	aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290.exe	82
PID 940 wrote to memory of 1544	940	aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290.exe	82
PID 940 wrote to memory of 1544	940	aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290.exe	82
PID 1544 wrote to memory of 3968	1544	omsecor.exe	100
PID 1544 wrote to memory of 3968	1544	omsecor.exe	100
PID 1544 wrote to memory of 3968	1544	omsecor.exe	100
PID 3968 wrote to memory of 1804	3968	omsecor.exe	101
PID 3968 wrote to memory of 1804	3968	omsecor.exe	101
PID 3968 wrote to memory of 1804	3968	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290.exe
"C:\Users\Admin\AppData\Local\Temp\aa1e7d99e22eb6fd8d46478e2ae9288901067c77e724ed0320b07d67c449e290.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 89KB
SHA256 64214892e93655d382db9ff51e6c0c7f1ce6324cc78a7374765e3ced3c59aa3a
MD5 a847b32009defd72a953dd60bbc03b89
SHA1 8fa027f8bd8031ef59f7981052df8253750a8385
SHA512 a0c1344efe84511d9fac1fe16a3475ff390dfdfedb958fd76278aafe16d83c5eb274f7a680b45c2a7521550bab98c20e5560c27062a694e28b304084dd78f67a
SSDEEP 768:bMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:bbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 89KB
SHA256 0519ac266b419cb71c14a82eeaf8a7484db418b6494043daeeecf7eca62411a6
MD5 80e33ba6c013dd7156ec0cf906778391
SHA1 f91683983348c496fe21872246e1b61d2b20751d
SHA512 665516bb981d1da9ffaa766791f83cb4eb3f06eee23959cae2739f8b1f98e5f8f6463168a1e9866b5d4aa2c230f8532e897991dafaf99d15cd8eb9508759f2c4
SSDEEP 768:nMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:nbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 89KB
SHA256 a9e18210bd9f731f9c623b46fcfb27514026ef34ac5a7077a61a9d4e0bed82e5
MD5 0455d67bc7f9b1f69f93dd4e3b07c1e3
SHA1 1cb4ad222ff731d39a18cfda8f7879af622e1827
SHA512 260e5a9347c5cc729d2bcb7f26f02a33310ffd38b40c43eedc7ab023fc199a82bb13662a61769d775f51e0d59eed56857f4f4b5ef78fde63428a2ced09fccb8d
SSDEEP 768:jMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:jbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads