neconyd | 0a49948fb5de5fb11fd604ca59622c6157615c2454e7f0214e98241bfda0f544

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0a49948fb5de5fb11fd604ca59622c6157615c2454e7f0214e98241bfda0f544.exe
Size 64KB
Sample240530-w71pdshc33
SHA256 0a49948fb5de5fb11fd604ca59622c6157615c2454e7f0214e98241bfda0f544
MD5 d5a3eb7eff6408df0fe04c8af1c092cd
SHA1 2b0783b978450482e1dd65f1a66796b68ad5deb7
SHA512 2d671d890e36091e2033f702ff9472789ab9f0b87e19233c7256609e1a2e5e78fd59373545f838503d2476d04082d4fc4dc66cf9e4686a8218206c438b59e40b
SSDEEP 768:rMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:rbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2236	omsecor.exe
3104	omsecor.exe
2912	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2236	2184	0a49948fb5de5fb11fd604ca59622c6157615c2454e7f0214e98241bfda0f544.exe	83
PID 2184 wrote to memory of 2236	2184	0a49948fb5de5fb11fd604ca59622c6157615c2454e7f0214e98241bfda0f544.exe	83
PID 2184 wrote to memory of 2236	2184	0a49948fb5de5fb11fd604ca59622c6157615c2454e7f0214e98241bfda0f544.exe	83
PID 2236 wrote to memory of 3104	2236	omsecor.exe	101
PID 2236 wrote to memory of 3104	2236	omsecor.exe	101
PID 2236 wrote to memory of 3104	2236	omsecor.exe	101
PID 3104 wrote to memory of 2912	3104	omsecor.exe	102
PID 3104 wrote to memory of 2912	3104	omsecor.exe	102
PID 3104 wrote to memory of 2912	3104	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\0a49948fb5de5fb11fd604ca59622c6157615c2454e7f0214e98241bfda0f544.exe
"C:\Users\Admin\AppData\Local\Temp\0a49948fb5de5fb11fd604ca59622c6157615c2454e7f0214e98241bfda0f544.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 969f84dc2ade76837a441ee91bacd3bb3f6b190482bda764c61d51ef1f12a4f7
MD5 630093524bf6f75f665920ed7912131f
SHA1 c61c77a3b31b26e8c81ff92cf7dc9c1bbb4cdefa
SHA512 98ee48aad753d72be71d7701d16be1653b22e6a8c39a3a46b3f4aa1d9443b9de9a8d8aded0fc4a1cbd4401d7ad82c471a23f218ff4f61edb99013c87f116872a
SSDEEP 768:1MEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:1bIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 036cb94ca08614b8e3093a9572d1e03d7ff7e0093f1c6e7f5c46b77d5020d792
MD5 6ed03740c41065de5e8cece7ca2b5234
SHA1 38ad01de870b343f64833e0ad294149ed8a253cd
SHA512 ba1a074d9dab8c2dbfbf9e68b2403742f5cad14378ac3d754d1bf9950f6ad52e9c6df593a5ebabf19b06285ccfe11466e1a6a17b9a9f1aa1e7b01d210044392e
SSDEEP 768:rMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:rbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 64KB
SHA256 c12b0dec6e510ebd75947c46a2b32e3ee9260f5673c4fbd7fba1cbb990acfa35
MD5 29b4c118cfeb802bb24b008d89e0f989
SHA1 db9e3be0b0c51313bab9ea64ce8ebe6bbf2c6101
SHA512 75bca2e3425b1118da0c03d55a5dd5b0c515f9ffaf6a26923fd6d7cf6bd0ec1a3d5442a0df679d9d5ed34f61701355249ece7b41a499aa557e418e0a20a0c3d8
SSDEEP 768:0MEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:0bIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads