neconyd | 2d96525d2879c56aa89f0eaa1e68f38aa7e17dd4996324345037ee478f7d0d76

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
810fd9b1a9294f01bb4292c8ee025ef0.exe
Size 72KB
Sample240602-b7739afd23
SHA256 2d96525d2879c56aa89f0eaa1e68f38aa7e17dd4996324345037ee478f7d0d76
MD5 810fd9b1a9294f01bb4292c8ee025ef0
SHA1 e3c3fdc46810454bd5a38327a9be969a546c3a33
SHA512 5704b9e27d690825badfb3f092209799e1a093953dd1f614794f9d6e7e237e9ce04b67f7e35ba628af5f6aa92f15a8033bac81f55d2f3158feeffd8da082371e
SSDEEP 1536:yd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:CdseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4592	omsecor.exe
3228	omsecor.exe
4596	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 4592	1952	810fd9b1a9294f01bb4292c8ee025ef0.exe	83
PID 1952 wrote to memory of 4592	1952	810fd9b1a9294f01bb4292c8ee025ef0.exe	83
PID 1952 wrote to memory of 4592	1952	810fd9b1a9294f01bb4292c8ee025ef0.exe	83
PID 4592 wrote to memory of 3228	4592	omsecor.exe	100
PID 4592 wrote to memory of 3228	4592	omsecor.exe	100
PID 4592 wrote to memory of 3228	4592	omsecor.exe	100
PID 3228 wrote to memory of 4596	3228	omsecor.exe	101
PID 3228 wrote to memory of 4596	3228	omsecor.exe	101
PID 3228 wrote to memory of 4596	3228	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\810fd9b1a9294f01bb4292c8ee025ef0.exe
"C:\Users\Admin\AppData\Local\Temp\810fd9b1a9294f01bb4292c8ee025ef0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3228
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 77c70d037beeedc6bbce76581a4d808cb58665c774a8465059876e977584b8a3
MD5 8aabb479313c677f29af04ab8cb560f7
SHA1 c73a56a52137307718792f64d2c646fbce65e367
SHA512 3d61d7c21beeab43b04f07934e43f9724b7f52226ed215a6b118e39720090f71e90c17ddae3fa5db931ae90c68edc9436e400dccd49242fb40d34034316c619e
SSDEEP 1536:Yd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:odseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 c485180f6374b954074322b6b7ff42f5f166154070bf6bcc1c2e8a33b99bffd9
MD5 0b96f84acd03531b5bcd6191ce8db510
SHA1 95128b9f56d17ad3ea3891b81555f5c67ac13a86
SHA512 90ccc5169a33953c0736eb7d14f5a8a9c32e603e8059357d6e62ed9e40f21af765b4c23ae9805a0509d4ae95b965d274ccf31a13091d0ffb803c1bc9a9bd71e9
SSDEEP 1536:qd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:qdseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 72KB
SHA256 c1b56be78c3ea3238fcf59a657e43d68fd34b92dc53381ecb353f5ec96ed5a00
MD5 616d171c712fc4b2d1cb9fdfa149d7a4
SHA1 e2cdd1ddc72a320d2baed1b57d9f4b2c5db6e6f8
SHA512 745a0f74debacc71dc7a03ee8e728821ef663025acc7a9ca47b3897a140a6916d13c8ad68cdcd45c1cddb1b28994fa9df5d75612f3e230c7e87527707323d1be
SSDEEP 1536:Ud9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:sdseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads