neconyd | c8e878d0de2db65da75abf76665b0a35d160c55e4bd361f0bd9b25668b92f900

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c8e878d0de2db65da75abf76665b0a35d160c55e4bd361f0bd9b25668b92f900.exe
Size 76KB
Sample240531-dcs2yscf3y
SHA256 c8e878d0de2db65da75abf76665b0a35d160c55e4bd361f0bd9b25668b92f900
MD5 6b34f09d178b6e05173a8105fded7383
SHA1 ab596617f8c68fd71c5480eb70a0928ccd19ff72
SHA512 bab75b2e2f4c6e17a11065d2558a2bc97114b9f77e50d029d243502c12296bbe740ad7a461d42b7b5fbd82468140154f81da4d822f66dbd252e91b4ed6aa60ee
SSDEEP 768:VMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:VbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4248	omsecor.exe
2284	omsecor.exe
3596	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 4248	1036	c8e878d0de2db65da75abf76665b0a35d160c55e4bd361f0bd9b25668b92f900.exe	81
PID 1036 wrote to memory of 4248	1036	c8e878d0de2db65da75abf76665b0a35d160c55e4bd361f0bd9b25668b92f900.exe	81
PID 1036 wrote to memory of 4248	1036	c8e878d0de2db65da75abf76665b0a35d160c55e4bd361f0bd9b25668b92f900.exe	81
PID 4248 wrote to memory of 2284	4248	omsecor.exe	94
PID 4248 wrote to memory of 2284	4248	omsecor.exe	94
PID 4248 wrote to memory of 2284	4248	omsecor.exe	94
PID 2284 wrote to memory of 3596	2284	omsecor.exe	95
PID 2284 wrote to memory of 3596	2284	omsecor.exe	95
PID 2284 wrote to memory of 3596	2284	omsecor.exe	95

C:\Users\Admin\AppData\Local\Temp\c8e878d0de2db65da75abf76665b0a35d160c55e4bd361f0bd9b25668b92f900.exe
"C:\Users\Admin\AppData\Local\Temp\c8e878d0de2db65da75abf76665b0a35d160c55e4bd361f0bd9b25668b92f900.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 42ab47b0148f05be414a53d9f75cc3748dafd2317618751b135f161e1e31c0cd
MD5 59b8cf466e59c637ddc11dfc62ec8510
SHA1 b05316f405b1b9f7634d7a07c5e2e7fb8b9a0557
SHA512 469cec95e8c8382e90bad08260af41cf14e7cf59895e96bfae542e1ae7603d079387a2969c4cfa0525afc1de08c33e0b2582bcece71c4c8213ffd2da7e97f19c
SSDEEP 768:3MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:3bIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 2ec458cc986337bae0a861d07b9273251e63f7c74cabc17b05bb38fc333862bd
MD5 8183f80488955259ef5f3db067d695e3
SHA1 eeecfaaa9bf52f13ebaa685daf4c1b0a39825714
SHA512 3e9d0ab63abfa60c1de55e58fd3c300722204782a327d848df14d5add1fce87797c0b0af181df32659c5ac4c650dd5ded9890363a16cf90d5402589c49c2d0c3
SSDEEP 768:1MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:1bIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 36736667cbc4a4aa0ad71efd30fd4703b029f6bebcf28fab6738e6530baa0542
MD5 bbcd00fb39164776dd9b8f232c16f406
SHA1 f448438a5cc35b3d386ffb6f24c99dbb3b6bb4a0
SHA512 530c098929244e3f352de9db231f34fa9b463a727bc46f2d291ed431ea39d4b718556e377b7ed3ea3a9d06aec35e4747e56dde3943152e2050ac60e62138532c
SSDEEP 768:zMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:zbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads