neconyd | 741973b266186c511b7d80600bc99cc9fc5314f696098eeb3285cd9301a07811

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
741973b266186c511b7d80600bc99cc9fc5314f696098eeb3285cd9301a07811.exe
Size 96KB
Sample240604-24ekmsfd42
SHA256 741973b266186c511b7d80600bc99cc9fc5314f696098eeb3285cd9301a07811
MD5 4e0b1f7bc6c2c239104e921f08403db7
SHA1 f0e2e033811cfd95b3c527755c78cff570f6a1f0
SHA512 59b572b600698e8852e0852415655016b62666f13c66ac9c40363e6cfae4f3cc25445dcdb709bb2ed4841cf9e869369255b14a4f09450a7c505241e1a22beb52
SSDEEP 1536:FnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:FGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Detects executables built or packed with MPress PE compressor 10 IoCs

resource	yara_rule
behavioral2/memory/4780-0-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0008000000022f51-8.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3808-10-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4780-17-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3808-18-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000b0000000233a4-28.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1132-33-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0008000000022f51-42.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1652-44-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1652-51-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 6 IoCs

pid	Process
3808	omsecor.exe
4760	omsecor.exe
1132	omsecor.exe
3240	omsecor.exe
1652	omsecor.exe
3144	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4780 set thread context of 2272	4780	741973b266186c511b7d80600bc99cc9fc5314f696098eeb3285cd9301a07811.exe	83
PID 3808 set thread context of 4760	3808	omsecor.exe	88
PID 1132 set thread context of 3240	1132	omsecor.exe	110
PID 1652 set thread context of 3144	1652	omsecor.exe	114

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1600	4780	WerFault.exe	82
60	3808	WerFault.exe	85
4548	1132	WerFault.exe	109
4872	1652	WerFault.exe	112

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 2272	4780	741973b266186c511b7d80600bc99cc9fc5314f696098eeb3285cd9301a07811.exe	83
PID 4780 wrote to memory of 2272	4780	741973b266186c511b7d80600bc99cc9fc5314f696098eeb3285cd9301a07811.exe	83
PID 4780 wrote to memory of 2272	4780	741973b266186c511b7d80600bc99cc9fc5314f696098eeb3285cd9301a07811.exe	83
PID 4780 wrote to memory of 2272	4780	741973b266186c511b7d80600bc99cc9fc5314f696098eeb3285cd9301a07811.exe	83
PID 4780 wrote to memory of 2272	4780	741973b266186c511b7d80600bc99cc9fc5314f696098eeb3285cd9301a07811.exe	83
PID 2272 wrote to memory of 3808	2272	741973b266186c511b7d80600bc99cc9fc5314f696098eeb3285cd9301a07811.exe	85
PID 2272 wrote to memory of 3808	2272	741973b266186c511b7d80600bc99cc9fc5314f696098eeb3285cd9301a07811.exe	85
PID 2272 wrote to memory of 3808	2272	741973b266186c511b7d80600bc99cc9fc5314f696098eeb3285cd9301a07811.exe	85
PID 3808 wrote to memory of 4760	3808	omsecor.exe	88
PID 3808 wrote to memory of 4760	3808	omsecor.exe	88
PID 3808 wrote to memory of 4760	3808	omsecor.exe	88
PID 3808 wrote to memory of 4760	3808	omsecor.exe	88
PID 3808 wrote to memory of 4760	3808	omsecor.exe	88
PID 4760 wrote to memory of 1132	4760	omsecor.exe	109
PID 4760 wrote to memory of 1132	4760	omsecor.exe	109
PID 4760 wrote to memory of 1132	4760	omsecor.exe	109
PID 1132 wrote to memory of 3240	1132	omsecor.exe	110
PID 1132 wrote to memory of 3240	1132	omsecor.exe	110
PID 1132 wrote to memory of 3240	1132	omsecor.exe	110
PID 1132 wrote to memory of 3240	1132	omsecor.exe	110
PID 1132 wrote to memory of 3240	1132	omsecor.exe	110
PID 3240 wrote to memory of 1652	3240	omsecor.exe	112
PID 3240 wrote to memory of 1652	3240	omsecor.exe	112
PID 3240 wrote to memory of 1652	3240	omsecor.exe	112
PID 1652 wrote to memory of 3144	1652	omsecor.exe	114
PID 1652 wrote to memory of 3144	1652	omsecor.exe	114
PID 1652 wrote to memory of 3144	1652	omsecor.exe	114
PID 1652 wrote to memory of 3144	1652	omsecor.exe	114
PID 1652 wrote to memory of 3144	1652	omsecor.exe	114

C:\Users\Admin\AppData\Local\Temp\741973b266186c511b7d80600bc99cc9fc5314f696098eeb3285cd9301a07811.exe
"C:\Users\Admin\AppData\Local\Temp\741973b266186c511b7d80600bc99cc9fc5314f696098eeb3285cd9301a07811.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\AppData\Local\Temp\741973b266186c511b7d80600bc99cc9fc5314f696098eeb3285cd9301a07811.exe
  C:\Users\Admin\AppData\Local\Temp\741973b266186c511b7d80600bc99cc9fc5314f696098eeb3285cd9301a07811.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4760
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1132
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:3144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 256
        8⤵
        Program crash
        
        PID:4872
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 292
        6⤵
        Program crash
        
        PID:4548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 288
      4⤵
      Program crash
      PID:60
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 288
  2⤵
  - Program crash
  PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4780 -ip 4780
1⤵
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3808 -ip 3808
1⤵
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1132 -ip 1132
1⤵
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1652 -ip 1652
1⤵
PID:4768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 5dcaa68f4f909095403838e6a7584a53a8e006b54b6ff5d6ea41e82fee840f30
MD5 92cf8e9e7aa7383249687bf45586f9dd
SHA1 fd0bc240de102db1a6aedf5f96dcd65b7c7789d3
SHA512 57988c82a65d642bd01949c06ba72caa418d17fc62fd47ae540aa230d31b9680d54cdc2189bcccae780c3134a5e4a240deeea9c286bb7ae173150625f80bf9d4
SSDEEP 1536:anAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:aGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 590fc7f046536dec15bb0ab807dd49b98805b2ba394520d17bb4cd514b5f2ac1
MD5 369b378076575250cb7be76123baee7d
SHA1 0d8fabd4e71498bc03d6cda7bc221ddaa78b72dc
SHA512 e74ea20d357f8def222802b51ce7cad505241bdd3ccd6c628430e035c7cd572e4c18090f616b148dd59105b583887173b4a82747bf434e71beb0da5b8090d617
SSDEEP 1536:cnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:cGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 9854aba9823c8bda9b0380222699f038e9cc0aa8e6f3ca3ad9923fb2a2912b2a
MD5 57b0d1e3baff0d22904a93919dc5e4c0
SHA1 303593a3c13766d5ab4f29e41271c519bfc78f77
SHA512 031be0e0b808a8a21213f572941aef96af563dc9f20ade000bbc3bc2cf343843b82251741d285571e79f34b65226cf1c19749ed1ea623fe6e3431184d5c970d2
SSDEEP 1536:enAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:eGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1132-33-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1652-44-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1652-51-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2272-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2272-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2272-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2272-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3144-52-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3144-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3144-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3144-55-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3240-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3240-41-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3240-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3808-18-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3808-10-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4760-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4760-30-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4760-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4760-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4760-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4760-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4760-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4780-17-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4780-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads