neconyd | e6c5aee1afe2b2f18285eaf9411a2d1ecaf816803430291714036a06dbd1de60

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e6c5aee1afe2b2f18285eaf9411a2d1ecaf816803430291714036a06dbd1de60.exe
Size 88KB
Sample240603-flacbadd95
SHA256 e6c5aee1afe2b2f18285eaf9411a2d1ecaf816803430291714036a06dbd1de60
MD5 e568d6b49a34dd9f437a2bc717830f59
SHA1 95977a1b428647ad712df3aea31ec7b6cf352def
SHA512 4a7d3cd7063eb0ac9bc02caff08076e83c97171caf8b0951aeda562da424e94bdfd72cf027fd20c9ffd8f661ca2ad785e9175541d91fd67d5453030450fe863d
SSDEEP 768:1MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:1bIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2504	omsecor.exe
4964	omsecor.exe
4812	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 2504	3612	e6c5aee1afe2b2f18285eaf9411a2d1ecaf816803430291714036a06dbd1de60.exe	85
PID 3612 wrote to memory of 2504	3612	e6c5aee1afe2b2f18285eaf9411a2d1ecaf816803430291714036a06dbd1de60.exe	85
PID 3612 wrote to memory of 2504	3612	e6c5aee1afe2b2f18285eaf9411a2d1ecaf816803430291714036a06dbd1de60.exe	85
PID 2504 wrote to memory of 4964	2504	omsecor.exe	102
PID 2504 wrote to memory of 4964	2504	omsecor.exe	102
PID 2504 wrote to memory of 4964	2504	omsecor.exe	102
PID 4964 wrote to memory of 4812	4964	omsecor.exe	103
PID 4964 wrote to memory of 4812	4964	omsecor.exe	103
PID 4964 wrote to memory of 4812	4964	omsecor.exe	103

C:\Users\Admin\AppData\Local\Temp\e6c5aee1afe2b2f18285eaf9411a2d1ecaf816803430291714036a06dbd1de60.exe
"C:\Users\Admin\AppData\Local\Temp\e6c5aee1afe2b2f18285eaf9411a2d1ecaf816803430291714036a06dbd1de60.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 2120c95e8539aad95a4aae1859a866aa29fbb740c8e0e82f34031b8a837968e3
MD5 44f4f7b694996f931a8c36522f2bf61f
SHA1 e0df7211861f91f4feb9a19722848dc61a2524d4
SHA512 db8b944c8b62b8bf206f13041d2f5149ff84fc4a840ab61158ad64a0496dcc706aecb7ba427d04499696dd64f1777b1d49ab821f60200aa63901297436050132
SSDEEP 768:QMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:QbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 af78494994cb64aa0c39d74036807aaef3f8260d7f242caa2d4477c36d18b20c
MD5 f835b88cafdfbef470c79919e5db8114
SHA1 ab881ba3d201cbf4c572d29d1231a207ddd3e838
SHA512 f54d2d95bc8e5c83306f9bfd1f4406965a33e7c9f48e7429ca1ddb588867bf8abb8e864aad03654c6e46ddaf24c7b378c3b680d272c65796f67b4c702f7fa4f9
SSDEEP 768:ZMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:ZbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 0468771ae08c221450943ff62d7d42ce7b6ae042b4666e0d2dc1efb8217e0bbd
MD5 41bd40729811ef0e7cc20cb8d24a0fa4
SHA1 9a7d0ea786606287f07d9875658fa9cfb52d5f40
SHA512 c018e710757e263f6ee0782e5cf1e5c03f606aba5b2a7fee0d5bddb41af6b64f0fbf61085a1f7eecc6b47327f6618702d784354e31ca9f3db3fc8d0a7097cd06
SSDEEP 768:4MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:4bIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads