neconyd | 383c5536be119f172b2fcb1862e11ae97638f80f34e3bf18b5e843cd6fcac585

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 20:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
383c5536be119f172b2fcb1862e11ae97638f80f34e3bf18b5e843cd6fcac585.exe
Size 62KB
Sample240601-y3st4aef42
SHA256 383c5536be119f172b2fcb1862e11ae97638f80f34e3bf18b5e843cd6fcac585
MD5 1596fd2046f72a6f9053d53e344a5fe0
SHA1 1972232e9b7a5bd3ae3d998b35dd20f90559b486
SHA512 db5d240b0941ace501543e464d221e49b09f30d823c92568d6d3657ee79885909773d5f2f64aaf2f8e71f27e951daea7ecf9f4b2c202d99d1e424555434ff927
SSDEEP 768:zMEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:zbIvYvZEyFKF6N4yS+AQmZtl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2492	omsecor.exe
4896	omsecor.exe
2732	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2492	1628	383c5536be119f172b2fcb1862e11ae97638f80f34e3bf18b5e843cd6fcac585.exe	83
PID 1628 wrote to memory of 2492	1628	383c5536be119f172b2fcb1862e11ae97638f80f34e3bf18b5e843cd6fcac585.exe	83
PID 1628 wrote to memory of 2492	1628	383c5536be119f172b2fcb1862e11ae97638f80f34e3bf18b5e843cd6fcac585.exe	83
PID 2492 wrote to memory of 4896	2492	omsecor.exe	97
PID 2492 wrote to memory of 4896	2492	omsecor.exe	97
PID 2492 wrote to memory of 4896	2492	omsecor.exe	97
PID 4896 wrote to memory of 2732	4896	omsecor.exe	98
PID 4896 wrote to memory of 2732	4896	omsecor.exe	98
PID 4896 wrote to memory of 2732	4896	omsecor.exe	98

C:\Users\Admin\AppData\Local\Temp\383c5536be119f172b2fcb1862e11ae97638f80f34e3bf18b5e843cd6fcac585.exe
"C:\Users\Admin\AppData\Local\Temp\383c5536be119f172b2fcb1862e11ae97638f80f34e3bf18b5e843cd6fcac585.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 62KB
SHA256 b593d5b554851926974183763b49ab6dc20b79783eb93784e2417388bf82d9bd
MD5 b905b1c19ea17841b13240c6c12f8abc
SHA1 1322b7d5a6d21472fad9d0e4694d62c20c8e950d
SHA512 14befd2146289869b896c99b12efda311333c4d248384c9c051032aa9c16ec56780c7775c7bd8d2f0f1261920a3318c15d91dbdc1e36e06a44108a2ddf2b9b51
SSDEEP 768:WMEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:WbIvYvZEyFKF6N4yS+AQmZtl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 62KB
SHA256 e0ca0bea9940a75b97a0bc4846faab54f5623ae18269ae52ffa99a3aded2899e
MD5 b63282d0e79005cd396dd305a0475512
SHA1 d9f7617fa1296312551ca4043d4b7c81a0a91600
SHA512 289a1d0a626e9366cc3ed8d5707afbb9e8334b61b298dbd209f9d12223e93a215dcff2a5c22fb6ad66eff9142df7067be74d51c7d4d4b9f23ccfb47bec1a1e77
SSDEEP 768:DMEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:DbIvYvZEyFKF6N4yS+AQmZtl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 62KB
SHA256 a244d76a88a85a308aa1c7c100e96dd719ab71d8b1bd97a702cc3e2a5449ec8c
MD5 fa22d4034f34a5781c6648d30317cd74
SHA1 e7a3dc18bb5e9ac5b3b8490ca500589fac368f88
SHA512 ab5011e332c478d9f034c7ea4ce2ed9df9ea3dcce6cef9f6e1d5cbe17cf6ee172a3070721d541b7a7af3e3176fea2fc1cf3053b316b150f76ea607fc99132111
SSDEEP 768:LMEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:LbIvYvZEyFKF6N4yS+AQmZtl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads