neconyd | dc3df50f62105d021485c90470310ef1d50aa8e934fca03a7bc956c902aadc9b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dc3df50f62105d021485c90470310ef1d50aa8e934fca03a7bc956c902aadc9b.exe
Size 68KB
Sample240602-d4q2nsaa99
SHA256 dc3df50f62105d021485c90470310ef1d50aa8e934fca03a7bc956c902aadc9b
MD5 298046e8c9e6891d4b2161f7f44ca8d0
SHA1 c3d77db2b6ab0800067cb475885ef2a7e30a36eb
SHA512 61065477c9e6cabe8668fbb504dc60987d471bb0fa58519338714f3e0be4c0222d40a79fe2ec29ff25543a1f40886ca061f7f03e0dbd9343551d73b401d2e4ac
SSDEEP 1536:fd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:XdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1184	omsecor.exe
2544	omsecor.exe
3124	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 1184	452	dc3df50f62105d021485c90470310ef1d50aa8e934fca03a7bc956c902aadc9b.exe	83
PID 452 wrote to memory of 1184	452	dc3df50f62105d021485c90470310ef1d50aa8e934fca03a7bc956c902aadc9b.exe	83
PID 452 wrote to memory of 1184	452	dc3df50f62105d021485c90470310ef1d50aa8e934fca03a7bc956c902aadc9b.exe	83
PID 1184 wrote to memory of 2544	1184	omsecor.exe	94
PID 1184 wrote to memory of 2544	1184	omsecor.exe	94
PID 1184 wrote to memory of 2544	1184	omsecor.exe	94
PID 2544 wrote to memory of 3124	2544	omsecor.exe	95
PID 2544 wrote to memory of 3124	2544	omsecor.exe	95
PID 2544 wrote to memory of 3124	2544	omsecor.exe	95

C:\Users\Admin\AppData\Local\Temp\dc3df50f62105d021485c90470310ef1d50aa8e934fca03a7bc956c902aadc9b.exe
"C:\Users\Admin\AppData\Local\Temp\dc3df50f62105d021485c90470310ef1d50aa8e934fca03a7bc956c902aadc9b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:452
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 68KB
SHA256 aa1b40b45f9b29aba613bfbaefd15e433fdfb88475b3def4c93ed04ed83d5ff6
MD5 11a8fe29ac68390075eb946cce4754d6
SHA1 a956b5b943569211bc5cc14578068e1aafb53599
SHA512 9ae235b1585837a0d9106324ae66f928b0dcd0301360a0c1593625df671ce25bd55742ac37daa71ec8475f59b25b097ece6a4e59b12235cf3a6d17e13f614395
SSDEEP 1536:Sd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:idseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 68KB
SHA256 faea39a8462552620f7601f2d3861cbeb164c92d31f05a1528345071598c5164
MD5 182684ca703097026a82f1df45ca6df4
SHA1 6ff5fa7a8e07da2ab8b311852985e7fa041c3628
SHA512 c3a0b7685dd21ad4891f530408e329d9ac6371fd451e92a61a91f0f951d4f6f493c2f9795331bb64d887dff28582cf803c612bc23c64ba9eee7de2ca14f159ff
SSDEEP 1536:Xd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:fdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 68KB
SHA256 e60855115214c9e6fe713f50fd39ed41b565c7f4af50487ef57eb282d355a2be
MD5 2e09f2ef4ff2ecb3b7efafd9c3e82e5d
SHA1 b43eab9d0ad23c7330842f3b0c2a4fe3cbb79f66
SHA512 d49d8a704d98f971be6562d01c68abd12a03c36ac456a344afe3ddc0d3e92df3815ece061eca54f9be70ad91640a3624801f67264b2faaea8f8420fe2ba6f8f7
SSDEEP 1536:6d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:adseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads