neconyd | 9cae85d24f881ac1b959433dbd60b8a8e48f22f63affccca2341a2989c00b599

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9cae85d24f881ac1b959433dbd60b8a8e48f22f63affccca2341a2989c00b599.exe
Size 96KB
Sample240530-a7mxmshc44
SHA256 9cae85d24f881ac1b959433dbd60b8a8e48f22f63affccca2341a2989c00b599
MD5 35daba8231fab3ab73313ad78237027e
SHA1 bc6d2bee09790350b6cff5311eb4d9bfc1bf342d
SHA512 35eaa2740793fe33ab6b4ab19500c06bc7e1428136513ccc0b8c1195c7ff8a92dabd101a7bf9d176a0641f710481a651824e1aca5e744a321bbe0f5ceb08b643
SSDEEP 1536:InAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:IGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Detects executables built or packed with MPress PE compressor 10 IoCs

resource	yara_rule
behavioral2/memory/3828-0-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0006000000023288-8.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/388-10-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3828-19-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/388-18-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000d0000000217e3-34.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3888-35-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0006000000023288-45.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1572-46-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1572-53-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 6 IoCs

pid	Process
388	omsecor.exe
932	omsecor.exe
3888	omsecor.exe
3732	omsecor.exe
1572	omsecor.exe
3496	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3828 set thread context of 4628	3828	9cae85d24f881ac1b959433dbd60b8a8e48f22f63affccca2341a2989c00b599.exe	82
PID 388 set thread context of 932	388	omsecor.exe	86
PID 3888 set thread context of 3732	3888	omsecor.exe	102
PID 1572 set thread context of 3496	1572	omsecor.exe	106

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1540	3828	WerFault.exe	81
4004	388	WerFault.exe	84
5072	3888	WerFault.exe	101
536	1572	WerFault.exe	104

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 4628	3828	9cae85d24f881ac1b959433dbd60b8a8e48f22f63affccca2341a2989c00b599.exe	82
PID 3828 wrote to memory of 4628	3828	9cae85d24f881ac1b959433dbd60b8a8e48f22f63affccca2341a2989c00b599.exe	82
PID 3828 wrote to memory of 4628	3828	9cae85d24f881ac1b959433dbd60b8a8e48f22f63affccca2341a2989c00b599.exe	82
PID 3828 wrote to memory of 4628	3828	9cae85d24f881ac1b959433dbd60b8a8e48f22f63affccca2341a2989c00b599.exe	82
PID 3828 wrote to memory of 4628	3828	9cae85d24f881ac1b959433dbd60b8a8e48f22f63affccca2341a2989c00b599.exe	82
PID 4628 wrote to memory of 388	4628	9cae85d24f881ac1b959433dbd60b8a8e48f22f63affccca2341a2989c00b599.exe	84
PID 4628 wrote to memory of 388	4628	9cae85d24f881ac1b959433dbd60b8a8e48f22f63affccca2341a2989c00b599.exe	84
PID 4628 wrote to memory of 388	4628	9cae85d24f881ac1b959433dbd60b8a8e48f22f63affccca2341a2989c00b599.exe	84
PID 388 wrote to memory of 932	388	omsecor.exe	86
PID 388 wrote to memory of 932	388	omsecor.exe	86
PID 388 wrote to memory of 932	388	omsecor.exe	86
PID 388 wrote to memory of 932	388	omsecor.exe	86
PID 388 wrote to memory of 932	388	omsecor.exe	86
PID 932 wrote to memory of 3888	932	omsecor.exe	101
PID 932 wrote to memory of 3888	932	omsecor.exe	101
PID 932 wrote to memory of 3888	932	omsecor.exe	101
PID 3888 wrote to memory of 3732	3888	omsecor.exe	102
PID 3888 wrote to memory of 3732	3888	omsecor.exe	102
PID 3888 wrote to memory of 3732	3888	omsecor.exe	102
PID 3888 wrote to memory of 3732	3888	omsecor.exe	102
PID 3888 wrote to memory of 3732	3888	omsecor.exe	102
PID 3732 wrote to memory of 1572	3732	omsecor.exe	104
PID 3732 wrote to memory of 1572	3732	omsecor.exe	104
PID 3732 wrote to memory of 1572	3732	omsecor.exe	104
PID 1572 wrote to memory of 3496	1572	omsecor.exe	106
PID 1572 wrote to memory of 3496	1572	omsecor.exe	106
PID 1572 wrote to memory of 3496	1572	omsecor.exe	106
PID 1572 wrote to memory of 3496	1572	omsecor.exe	106
PID 1572 wrote to memory of 3496	1572	omsecor.exe	106

C:\Users\Admin\AppData\Local\Temp\9cae85d24f881ac1b959433dbd60b8a8e48f22f63affccca2341a2989c00b599.exe
"C:\Users\Admin\AppData\Local\Temp\9cae85d24f881ac1b959433dbd60b8a8e48f22f63affccca2341a2989c00b599.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Users\Admin\AppData\Local\Temp\9cae85d24f881ac1b959433dbd60b8a8e48f22f63affccca2341a2989c00b599.exe
  C:\Users\Admin\AppData\Local\Temp\9cae85d24f881ac1b959433dbd60b8a8e48f22f63affccca2341a2989c00b599.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:388
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:932
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3888
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:3496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 268
        8⤵
        Program crash
        
        PID:536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 292
        6⤵
        Program crash
        
        PID:5072
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 288
      4⤵
      Program crash
      PID:4004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 288
  2⤵
  - Program crash
  PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3828 -ip 3828
1⤵
PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 388 -ip 388
1⤵
PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3888 -ip 3888
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1572 -ip 1572
1⤵
PID:4600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 f1bf42413cb0abfa19aabf3b829d5f67d1a80cb7c0a478bc91009399c56919c8
MD5 6e869010ecb4620dc2bc8d8678b72217
SHA1 becc32a7a37be46645e31e52098f80738ba6102f
SHA512 e8c26e299275b714b8ff75e8a569b08866f6d8b248b56a01243aa077452f452dd6a962e82358a502bd2a8718af7f15079b305aa3177db569cb420b86924fb157
SSDEEP 1536:9nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:9Gs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 46c9050d629c1bea1d6fe46e4e0559cbcf4f912a21c2e81db535e9f328ff31c4
MD5 4131374a5498fcda05f105581070a2f8
SHA1 4df1851521675b26dc64d78d4aa0edf07f5a2758
SHA512 9b53decbeec86c3382abe160af3619c626fae0fbfe1e829e343ed61a92773ca3a361da6ae6dc6ebdb385eff2dad308ddabded7ff561958a838a48ec7dd9a345c
SSDEEP 1536:YnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:YGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 b16955fac156bbac45b2c17a4d84cfb49fea704aae17fda833a7d8dc7b230dd6
MD5 045dc203d0e681f877ec33569d0a4dfd
SHA1 a9a8494616f3a974a9ffbd6aac36704c8616d4a2
SHA512 b6a2fd3437e8f41e46bc543cbac024cbcb3e5b0301580de408b18b31da3f767f8304e03c317838437dff7ef7731b33d15f2c7a9eb85e1582c68f08088f17b753
SSDEEP 1536:hnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:hGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-10-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/388-18-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/932-27-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/932-33-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/932-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/932-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/932-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/932-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/932-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1572-46-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1572-53-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3496-57-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3496-54-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3496-51-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3496-50-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3732-44-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3732-38-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3732-39-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3828-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3828-19-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3888-35-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4628-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4628-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4628-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4628-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads