neconyd | 6eea9fcc5feb1589625ce71df555daf66d9343fc14dfc2c8bfc77b642409e49e

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6eea9fcc5feb1589625ce71df555daf66d9343fc14dfc2c8bfc77b642409e49e.exe
Size 73KB
Sample240602-3ch97aca45
SHA256 6eea9fcc5feb1589625ce71df555daf66d9343fc14dfc2c8bfc77b642409e49e
MD5 5c81876aa87d4c219e2316b34a860b3a
SHA1 578eb709d10deedc316425ab61ea3618473d1344
SHA512 9252e048fe86726fda2a16b390ad1f1d403de8ebe9a38ce839127b1910e4e1fb75db869f051cf81f682c912bc0a0741ae06498c872e2beb746b27712ce0399ff
SSDEEP 1536:Zd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:5dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4168	omsecor.exe
3536	omsecor.exe
2468	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 4168	1192	6eea9fcc5feb1589625ce71df555daf66d9343fc14dfc2c8bfc77b642409e49e.exe	83
PID 1192 wrote to memory of 4168	1192	6eea9fcc5feb1589625ce71df555daf66d9343fc14dfc2c8bfc77b642409e49e.exe	83
PID 1192 wrote to memory of 4168	1192	6eea9fcc5feb1589625ce71df555daf66d9343fc14dfc2c8bfc77b642409e49e.exe	83
PID 4168 wrote to memory of 3536	4168	omsecor.exe	95
PID 4168 wrote to memory of 3536	4168	omsecor.exe	95
PID 4168 wrote to memory of 3536	4168	omsecor.exe	95
PID 3536 wrote to memory of 2468	3536	omsecor.exe	96
PID 3536 wrote to memory of 2468	3536	omsecor.exe	96
PID 3536 wrote to memory of 2468	3536	omsecor.exe	96

C:\Users\Admin\AppData\Local\Temp\6eea9fcc5feb1589625ce71df555daf66d9343fc14dfc2c8bfc77b642409e49e.exe
"C:\Users\Admin\AppData\Local\Temp\6eea9fcc5feb1589625ce71df555daf66d9343fc14dfc2c8bfc77b642409e49e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 73KB
SHA256 fa974df069ada9f5215fa8ac62bfe9164cf363d7f036dfad20d2368e581252b6
MD5 f44473e4b276625cecbc93b2c5070e03
SHA1 6ffa3cc21a812bf8ddc6bd152e40cc710f559100
SHA512 e22f1030089b637938e0525abbc91a30fd5604f9ba8b49cf981f625f56e2bcfda7fe6e605fc4c7936662f387b14dc90524b8cbf30c29b6723cdd876303f77b18
SSDEEP 1536:Vd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:ddseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 73KB
SHA256 62e0993045a887ee6621b395eb9770d7e62a6de79364d4469828f3b5c490d747
MD5 a03fc2deddb5dc1fabcc9e00aa1d9575
SHA1 770ee5f183854c873403ee1d9f6b50d4f12be7cf
SHA512 7a98f46eb3cc0396832cb5167d209a2de8f5b3687fdadfa009f0342f7f7026959625f09f6a372719099be10badc7c5e1ecc4019868f6806445c7db733ec23ab6
SSDEEP 1536:Bd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:xdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 73KB
SHA256 1fcdce08fb071be8ae0743b8e0361841ce4f2cf7d1f33d9438643ec00f693430
MD5 5fa06e39f002183e476023c88b05b0c3
SHA1 88de844c24ad24beb8b3a17592de94cdfbe7095e
SHA512 447cf83d7e67866f6472c46559a033ed0f0bdd9a69631b0bd4b0249847ff3c6d7c3b4f4a57ef5e5fc25a2967a142b3c3a8a782b11dab43072f6251d5a28ab6a1
SSDEEP 1536:td9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:FdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads