neconyd | e3268544e481a3fab5de4e49aad9b22d9b43d22c68b7fe63c2ce34b668fe1cc1

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 04:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3268544e481a3fab5de4e49aad9b22d9b43d22c68b7fe63c2ce34b668fe1cc1.exe
Size 68KB
Sample240603-fgsyvsdc77
SHA256 e3268544e481a3fab5de4e49aad9b22d9b43d22c68b7fe63c2ce34b668fe1cc1
MD5 b6567f24c4004c167e312a01c492399f
SHA1 c8a70e449b5905b320ff8153beb3c353e85f66d9
SHA512 3ca110b8dcea0eed0172e61a109d0181f568ae4b2507157cb683b1024d93835bb6ba85cb3dbd8d1ec67c42b26b272b36d3afda5f9d474b34955b0bbee51e1ef8
SSDEEP 1536:Ad9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:gdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2380	omsecor.exe
2456	omsecor.exe
2200	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2380	1868	e3268544e481a3fab5de4e49aad9b22d9b43d22c68b7fe63c2ce34b668fe1cc1.exe	84
PID 1868 wrote to memory of 2380	1868	e3268544e481a3fab5de4e49aad9b22d9b43d22c68b7fe63c2ce34b668fe1cc1.exe	84
PID 1868 wrote to memory of 2380	1868	e3268544e481a3fab5de4e49aad9b22d9b43d22c68b7fe63c2ce34b668fe1cc1.exe	84
PID 2380 wrote to memory of 2456	2380	omsecor.exe	96
PID 2380 wrote to memory of 2456	2380	omsecor.exe	96
PID 2380 wrote to memory of 2456	2380	omsecor.exe	96
PID 2456 wrote to memory of 2200	2456	omsecor.exe	97
PID 2456 wrote to memory of 2200	2456	omsecor.exe	97
PID 2456 wrote to memory of 2200	2456	omsecor.exe	97

C:\Users\Admin\AppData\Local\Temp\e3268544e481a3fab5de4e49aad9b22d9b43d22c68b7fe63c2ce34b668fe1cc1.exe
"C:\Users\Admin\AppData\Local\Temp\e3268544e481a3fab5de4e49aad9b22d9b43d22c68b7fe63c2ce34b668fe1cc1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 68KB
SHA256 97e6989a3284fc2ad6dd55e2f5c1d3fe3fbf00351795302295820f4486dd033b
MD5 9cbc977cab511c8555b964c8cc4f289f
SHA1 4b875d00ca235f1448dfebff332092cd09bb355d
SHA512 ad5600070170ee72cf4cd833eb0d54192b70a4f47a52bf7389b06de0ad72e7a6d0f223a3e33c4ec9bffa0fab46726fb667ef7dd1874158523e13b89bfa1e2893
SSDEEP 1536:qd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:qdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 68KB
SHA256 e07133c2185edc1638624a9de4513c3fa3a0e89933ec7651b96515cc42be5df2
MD5 8c33942c69512df9b433ca54fa83213b
SHA1 95704b13059acb4b46d3f82714bdc51667a82c47
SHA512 424990ad7bee55c08d810eef7b23edf67c0558228d04f93dec26c6a947eee92dc37c5c7780cba60824f64edc9867f4941f172f54ffc188d47fdbdea3b7d3252a
SSDEEP 1536:Md9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:0dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 68KB
SHA256 2bc6806079ea71da63bec5528683e4c89771a9855338b4c35a26c556c9495e9c
MD5 4eabcbad32357bc24c926f237a95aec1
SHA1 799b33e727f0f3cebaeb9521d49dcbdf73e2d3bc
SHA512 03b8396d9771779b09cf5e3f9ddf04ec03205baa9e19322120796e81c3a7352fdd37c6d9d1afdbbb543de70bb4e8df735cc053b1c0003e959b5f7936dc310de2
SSDEEP 1536:jd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:DdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads