neconyd | 6194d2074a99fbcc9b440249b3d351b09e6eb5e571f53b3497577e9a77dda440

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6194d2074a99fbcc9b440249b3d351b09e6eb5e571f53b3497577e9a77dda440.exe
Size 96KB
Sample240604-18q9kaeb67
SHA256 6194d2074a99fbcc9b440249b3d351b09e6eb5e571f53b3497577e9a77dda440
MD5 08d2fbff8f3f281727e29808dea38588
SHA1 f8f1c017fc968f85509cbb77ed7f45969ff3dbec
SHA512 d79982b299ee309c4e1ad15fa7c39efe59c75709b952625828a6c2010bcbac2be09c7492fcbfa6a2db58f84779b1aaf32dc060120cfaf8864de876107fc3d5da
SSDEEP 1536:qnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:qGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Detects executables built or packed with MPress PE compressor 10 IoCs

resource	yara_rule
behavioral2/memory/4916-0-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x00090000000235b7-10.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4356-11-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4916-17-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4356-18-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000d0000000235c5-32.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4964-33-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x00090000000235b7-43.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/844-44-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/844-52-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 6 IoCs

pid	Process
4356	omsecor.exe
2328	omsecor.exe
4964	omsecor.exe
1888	omsecor.exe
844	omsecor.exe
2532	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4916 set thread context of 2704	4916	6194d2074a99fbcc9b440249b3d351b09e6eb5e571f53b3497577e9a77dda440.exe	91
PID 4356 set thread context of 2328	4356	omsecor.exe	95
PID 4964 set thread context of 1888	4964	omsecor.exe	117
PID 844 set thread context of 2532	844	omsecor.exe	121

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1396	4916	WerFault.exe	90
3900	4356	WerFault.exe	93
3644	4964	WerFault.exe	116
2252	844	WerFault.exe	119

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2704	4916	6194d2074a99fbcc9b440249b3d351b09e6eb5e571f53b3497577e9a77dda440.exe	91
PID 4916 wrote to memory of 2704	4916	6194d2074a99fbcc9b440249b3d351b09e6eb5e571f53b3497577e9a77dda440.exe	91
PID 4916 wrote to memory of 2704	4916	6194d2074a99fbcc9b440249b3d351b09e6eb5e571f53b3497577e9a77dda440.exe	91
PID 4916 wrote to memory of 2704	4916	6194d2074a99fbcc9b440249b3d351b09e6eb5e571f53b3497577e9a77dda440.exe	91
PID 4916 wrote to memory of 2704	4916	6194d2074a99fbcc9b440249b3d351b09e6eb5e571f53b3497577e9a77dda440.exe	91
PID 2704 wrote to memory of 4356	2704	6194d2074a99fbcc9b440249b3d351b09e6eb5e571f53b3497577e9a77dda440.exe	93
PID 2704 wrote to memory of 4356	2704	6194d2074a99fbcc9b440249b3d351b09e6eb5e571f53b3497577e9a77dda440.exe	93
PID 2704 wrote to memory of 4356	2704	6194d2074a99fbcc9b440249b3d351b09e6eb5e571f53b3497577e9a77dda440.exe	93
PID 4356 wrote to memory of 2328	4356	omsecor.exe	95
PID 4356 wrote to memory of 2328	4356	omsecor.exe	95
PID 4356 wrote to memory of 2328	4356	omsecor.exe	95
PID 4356 wrote to memory of 2328	4356	omsecor.exe	95
PID 4356 wrote to memory of 2328	4356	omsecor.exe	95
PID 2328 wrote to memory of 4964	2328	omsecor.exe	116
PID 2328 wrote to memory of 4964	2328	omsecor.exe	116
PID 2328 wrote to memory of 4964	2328	omsecor.exe	116
PID 4964 wrote to memory of 1888	4964	omsecor.exe	117
PID 4964 wrote to memory of 1888	4964	omsecor.exe	117
PID 4964 wrote to memory of 1888	4964	omsecor.exe	117
PID 4964 wrote to memory of 1888	4964	omsecor.exe	117
PID 4964 wrote to memory of 1888	4964	omsecor.exe	117
PID 1888 wrote to memory of 844	1888	omsecor.exe	119
PID 1888 wrote to memory of 844	1888	omsecor.exe	119
PID 1888 wrote to memory of 844	1888	omsecor.exe	119
PID 844 wrote to memory of 2532	844	omsecor.exe	121
PID 844 wrote to memory of 2532	844	omsecor.exe	121
PID 844 wrote to memory of 2532	844	omsecor.exe	121
PID 844 wrote to memory of 2532	844	omsecor.exe	121
PID 844 wrote to memory of 2532	844	omsecor.exe	121

C:\Users\Admin\AppData\Local\Temp\6194d2074a99fbcc9b440249b3d351b09e6eb5e571f53b3497577e9a77dda440.exe
"C:\Users\Admin\AppData\Local\Temp\6194d2074a99fbcc9b440249b3d351b09e6eb5e571f53b3497577e9a77dda440.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Local\Temp\6194d2074a99fbcc9b440249b3d351b09e6eb5e571f53b3497577e9a77dda440.exe
  C:\Users\Admin\AppData\Local\Temp\6194d2074a99fbcc9b440249b3d351b09e6eb5e571f53b3497577e9a77dda440.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2328
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4964
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1888
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:844
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:2532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 268
        8⤵
        Program crash
        
        PID:2252
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 292
        6⤵
        Program crash
        
        PID:3644
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 276
      4⤵
      Program crash
      PID:3900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 288
  2⤵
  - Program crash
  PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4916 -ip 4916
1⤵
PID:628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4356 -ip 4356
1⤵
PID:1304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3772,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:8
1⤵
PID:928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4964 -ip 4964
1⤵
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 844 -ip 844
1⤵
PID:2484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 5528daa4986b6c33548456f259c2fa6bd75211b8048e7d1e8d648cefde368ba1
MD5 6b4b1b51d8799da603ceb78817a676a9
SHA1 cd76945d6dd8d99cdac23060aa751964df175405
SHA512 111c56595498f3b649725b369775752c09362b844f8c292d0c2da55dd74680b4003e9dba2f45229502faf311994a68eb3c1d1ecbbe4bde9756019b6f70cf1a4a
SSDEEP 1536:unAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:uGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 f78b3c78bba22fe9b071d949ba871988d817accfaefc759a3ccc948fdda8095d
MD5 bcfccb945c274be61eae9f1506ecea12
SHA1 90ca52d396d768d13413c77c5d04cd38775c9f80
SHA512 81e6bfb326f239783a0a9d0c246fe70b785ec0d2f4c3888363219a2f98a2cfd5510c1ac6a2605b284fa978a86fd3844e2e11e843b862b35661c5849750829463
SSDEEP 1536:3nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:3Gs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 0d16c2600898887f0f8558c284944554e2d4d21ce14ea47999ecc5b9befb5f51
MD5 86a567589fc9999db6c1bd65396e1d34
SHA1 097b946f8f58acecf939bf95f8132e5a4807688e
SHA512 ff0cb1448d38969ae789e8554743c3d5cd103d7a57dd478ba245945320ab8522337d239dd8c76a989cc7aa08f4a2a7d027a6a1062f855fd7a3f9bc41d1f2ce35
SSDEEP 1536:3nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:3Gs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/844-52-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/844-44-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1888-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1888-41-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1888-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2328-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2328-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2328-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2328-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2328-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2328-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2328-30-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2532-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2532-56-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2532-53-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2532-50-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2704-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2704-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2704-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2704-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4356-11-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4356-18-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4916-17-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4916-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4964-33-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads