neconyd | e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787.exe
Size 88KB
Sample240530-eqpgcsea2x
SHA256 e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787
MD5 37819cbdcd4262853dd67db9211e605f
SHA1 94e2797ddc43704c9b666020786b29e96f4eed69
SHA512 9c7ce92910a6baa9cfab90dc64f716041f30c70a696ce134a7855eb2e3b64db349e36e761f423540625cb762908aee62be8ca0c35678d2fa92f19e26c70b1123
SSDEEP 1536:Id9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:4dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2216	omsecor.exe
2688	omsecor.exe
1032	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2204	e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787.exe
2204	e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787.exe
2216	omsecor.exe
2216	omsecor.exe
2688	omsecor.exe
2688	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2216	2204	e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787.exe	28
PID 2204 wrote to memory of 2216	2204	e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787.exe	28
PID 2204 wrote to memory of 2216	2204	e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787.exe	28
PID 2204 wrote to memory of 2216	2204	e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787.exe	28
PID 2216 wrote to memory of 2688	2216	omsecor.exe	32
PID 2216 wrote to memory of 2688	2216	omsecor.exe	32
PID 2216 wrote to memory of 2688	2216	omsecor.exe	32
PID 2216 wrote to memory of 2688	2216	omsecor.exe	32
PID 2688 wrote to memory of 1032	2688	omsecor.exe	33
PID 2688 wrote to memory of 1032	2688	omsecor.exe	33
PID 2688 wrote to memory of 1032	2688	omsecor.exe	33
PID 2688 wrote to memory of 1032	2688	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787.exe
"C:\Users\Admin\AppData\Local\Temp\e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 a0855e0cc3394e86293a08ecb9a1b45f8ef24b831576e8511f084e7f1030fed4
MD5 5676a8669b7ca8b3b8dab355d3533311
SHA1 48bfed018abd037f4478b74bbbc33b547068410f
SHA512 68c88619073c9d0b3829ab7bc6043893d24c020b900bfc3bcb4ebfc3eb5a120120bf46e5f30e9f45a403e156705ddcea49e36dbc6ba9c585a2d2f0beca608307
SSDEEP 1536:ud9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:2dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 b2528a52232f685733cbddd09509437315c9f96d9bbdc9a3bb97e9c9d3b089cc
MD5 558068460ab3b0e39cdf41fdd1dc7171
SHA1 7a89967207f9f1f7265d49c75c0c9fb663478848
SHA512 e6137655d030c55076f2a4dd67e3381e66677fe99c643a8cc7c78533b9e0ecf2b7d6212d6a4b0cc0b6b1989809bf8e9a8a53aa6dd4de766ff2337538ff2f948e
SSDEEP 1536:sd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:UdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 d354800330956e71f3a79b6f193bf02a1683995aea366c8da9c6f9ed8ae72ed9
MD5 ee6c72fc54665cc9060d964b3e75f828
SHA1 29993973bc962042bd9f06a46ba6c1289f771c08
SHA512 6450aaba56568bc15ab5bf7523589fee492e42912f3bc1f748553513294c3a89828629c7374e9ef62256f9a2ed5f13e3a92536239b33424ea77f8c4e15776771
SSDEEP 1536:Gd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:+dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads