neconyd | 8ee8b255992d1ec0805985d43e4f4b921f1178ab4f55e773abf9787b9d935115

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8ee8b255992d1ec0805985d43e4f4b921f1178ab4f55e773abf9787b9d935115.exe
Size 92KB
Sample240603-bcfqhsdd7v
SHA256 8ee8b255992d1ec0805985d43e4f4b921f1178ab4f55e773abf9787b9d935115
MD5 b7e4429da104b9a39575301e69e30698
SHA1 3e96f59939dcc89f022e790e984dcfa2a23306de
SHA512 78bcf65c598910c9a2a1e77845d158a83b6695229a33302343a25897f8ad0f107aa14060f6ade98930b37c6d266902551e16634991ee51024d88b1873cf3a417
SSDEEP 768:5MEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:5bIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4364	omsecor.exe
3660	omsecor.exe
4548	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 4364	3856	8ee8b255992d1ec0805985d43e4f4b921f1178ab4f55e773abf9787b9d935115.exe	82
PID 3856 wrote to memory of 4364	3856	8ee8b255992d1ec0805985d43e4f4b921f1178ab4f55e773abf9787b9d935115.exe	82
PID 3856 wrote to memory of 4364	3856	8ee8b255992d1ec0805985d43e4f4b921f1178ab4f55e773abf9787b9d935115.exe	82
PID 4364 wrote to memory of 3660	4364	omsecor.exe	98
PID 4364 wrote to memory of 3660	4364	omsecor.exe	98
PID 4364 wrote to memory of 3660	4364	omsecor.exe	98
PID 3660 wrote to memory of 4548	3660	omsecor.exe	99
PID 3660 wrote to memory of 4548	3660	omsecor.exe	99
PID 3660 wrote to memory of 4548	3660	omsecor.exe	99

C:\Users\Admin\AppData\Local\Temp\8ee8b255992d1ec0805985d43e4f4b921f1178ab4f55e773abf9787b9d935115.exe
"C:\Users\Admin\AppData\Local\Temp\8ee8b255992d1ec0805985d43e4f4b921f1178ab4f55e773abf9787b9d935115.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 0ddf7a704ede8706310b538a5befe76a43ebd23d8649d972fbec198469f9f00c
MD5 a1a501fd1e95cc5f6b55ac7db41f1bde
SHA1 59b15f2e73cf64433618babe2bc83483acf013a3
SHA512 c314a280e34fdc1879fa82f34aa0de9b4fedde660dcd1e3e0c7a65257f5a9a8fc7e41a08b641caa30c255d61215631f3e5713a8cbdf96e8bf438c187cffe46e6
SSDEEP 768:EMEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:EbIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 3be4089c4035df8a4622c7c2fa901220ecd30e9543ccbfba6f8c23804f6a5281
MD5 66cb44b43f3fe26b3cc2cc9e5fcacc53
SHA1 29c29b61960e20089e6ee2ed65e7004e5adb1238
SHA512 3ec84f7902f7b0bb25506c3668e9ca094a6f802a3b35dceed0c554bab21ecc9884d2c4c1d65371d92c81af1315415f8ec0a7aa49b2e71d560412f71f719f2d70
SSDEEP 768:tMEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:tbIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 92KB
SHA256 c1203d1d0b2a46090f0f50bbf3340e5ecfadbb5c7ce283e196da6a2ad8594b54
MD5 ada9a1ec3d5be3fec353ced9d9d8706a
SHA1 c4e0fa8d58fb162e564673a975450820111c8e34
SHA512 2872ba044bfbc75390479e7cef7b896ae27fbf4d55c24e01890ea3646e1ff8be4f040af1bc91e8d3c020fe38bf34c4e0c86a733b7731c7a6e1afca7a51bac448
SSDEEP 768:0MEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:0bIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3660-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3660-17-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3856-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3856-5-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4364-4-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4364-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4364-11-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4548-19-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4548-20-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads