neconyd | e89ed7b9eb4c982a3d70b1245a4dff640205ccbed722ad2e4307ae25201f2594

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e89ed7b9eb4c982a3d70b1245a4dff640205ccbed722ad2e4307ae25201f2594.exe
Size 84KB
Sample240530-e5mw3sff58
SHA256 e89ed7b9eb4c982a3d70b1245a4dff640205ccbed722ad2e4307ae25201f2594
MD5 68b98e301b019ed7e63312a1536d6d9d
SHA1 a86356f79d446ae6857b94df1923e3fe8779e95a
SHA512 45cfe14307b298c8fb07795671fa9884b9248d02947408850ee7181e59cf68923013fceccbbef640600efc111fdaa05333fe4cba92151e530852f47ecd78dc03
SSDEEP 1536:Bd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:xdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4560	omsecor.exe
1460	omsecor.exe
4608	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4560	4508	e89ed7b9eb4c982a3d70b1245a4dff640205ccbed722ad2e4307ae25201f2594.exe	83
PID 4508 wrote to memory of 4560	4508	e89ed7b9eb4c982a3d70b1245a4dff640205ccbed722ad2e4307ae25201f2594.exe	83
PID 4508 wrote to memory of 4560	4508	e89ed7b9eb4c982a3d70b1245a4dff640205ccbed722ad2e4307ae25201f2594.exe	83
PID 4560 wrote to memory of 1460	4560	omsecor.exe	101
PID 4560 wrote to memory of 1460	4560	omsecor.exe	101
PID 4560 wrote to memory of 1460	4560	omsecor.exe	101
PID 1460 wrote to memory of 4608	1460	omsecor.exe	102
PID 1460 wrote to memory of 4608	1460	omsecor.exe	102
PID 1460 wrote to memory of 4608	1460	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\e89ed7b9eb4c982a3d70b1245a4dff640205ccbed722ad2e4307ae25201f2594.exe
"C:\Users\Admin\AppData\Local\Temp\e89ed7b9eb4c982a3d70b1245a4dff640205ccbed722ad2e4307ae25201f2594.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 24e09d7fb6cf34dde9109887fc87be61e1ccc590a991b82dd088b0a9da4d6850
MD5 fd047e5f6db607408af754bdffb3c23f
SHA1 e255bb89a6ade1281686eaea2b10f33b8d65c6b2
SHA512 47040b6f4afa27f51708d04bbf00de8a678f4a5b2ec144c4c77d3c86effb15fcbf91e5a45f48af137147868af4839e70950e35aa32b314abde140b95bf95d232
SSDEEP 1536:8d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:EdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 78508f24b2c0537b14822e0df329d23e4f962ba7b5661f990e6af072836bd355
MD5 f9b6ad66fa0bed5989d02ad6d512d8c1
SHA1 c3b0d07d44663a5ad3c7297164dfa8c085e1f57e
SHA512 75a81cef4ff6be511943f4caa4184d933292447103cf9d6d00eb9007144bf601e83691b05b3f7dabf49c2138f0b7c65cfdf74f73ba1d695be471cb4e4b983617
SSDEEP 1536:Nd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:ldseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 3422b385007a266e73a79b51a7576830cf0a58cc8d12b74da80a7a07f7724350
MD5 7d4805591ce899248224b0174d7eb791
SHA1 13af9839147030fb99dc41b2baa9a3ca5c5a9e5f
SHA512 5523473d7caf8872628a1345fd2d6c3364056a1a635da81cba21d6e6ce7dfbd7414498c11d888a25aa4846dc7e214991d6989b329f35b5557e49c6f22a648131
SSDEEP 1536:Ad9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:gdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads