neconyd | 935f6b32f0c7485b268245c0e0ba29ec41e718413d190152209c381fc750ffbe

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
935f6b32f0c7485b268245c0e0ba29ec41e718413d190152209c381fc750ffbe.exe
Size 61KB
Sample240604-ameersfc42
SHA256 935f6b32f0c7485b268245c0e0ba29ec41e718413d190152209c381fc750ffbe
MD5 42637db6363968f1cbc589d27a9a7b82
SHA1 29fdaed21065c2724862d34219cc844573bf2621
SHA512 c4cf348c3ecaacfa5fc04f9d385828e0edcfb083355fe97474c904e09ba3c956f4d3810616de5aa04baa895a957f88877a9fb09b61c020d3cbeed8aeef707e40
SSDEEP 768:CMEIvFGvZEr8LFK0ic46N47eSdYAHwmZ7Bp6JXXlaa5uA:CbIvYvZEyFKF6N4yS+AQmZIl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2228	omsecor.exe
4312	omsecor.exe
3332	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2228	2164	935f6b32f0c7485b268245c0e0ba29ec41e718413d190152209c381fc750ffbe.exe	82
PID 2164 wrote to memory of 2228	2164	935f6b32f0c7485b268245c0e0ba29ec41e718413d190152209c381fc750ffbe.exe	82
PID 2164 wrote to memory of 2228	2164	935f6b32f0c7485b268245c0e0ba29ec41e718413d190152209c381fc750ffbe.exe	82
PID 2228 wrote to memory of 4312	2228	omsecor.exe	97
PID 2228 wrote to memory of 4312	2228	omsecor.exe	97
PID 2228 wrote to memory of 4312	2228	omsecor.exe	97
PID 4312 wrote to memory of 3332	4312	omsecor.exe	98
PID 4312 wrote to memory of 3332	4312	omsecor.exe	98
PID 4312 wrote to memory of 3332	4312	omsecor.exe	98

C:\Users\Admin\AppData\Local\Temp\935f6b32f0c7485b268245c0e0ba29ec41e718413d190152209c381fc750ffbe.exe
"C:\Users\Admin\AppData\Local\Temp\935f6b32f0c7485b268245c0e0ba29ec41e718413d190152209c381fc750ffbe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 98b1824d5536042c9465c451d60fbee9eddb250ad2752c20789b4d2374c0fbe3
MD5 aff091988d295323669e83a0c5f35c10
SHA1 add26fa55d1686685734a32819f59cf4dfa9ab41
SHA512 fd0d3908d3db5fcda02d0933774db57d55e37cb7d3c7cd7f7f3d88ae184a4f46dc2e03e373c1dd87331ae7e90c7e6528306138bfa233adeb4f393aaf29ead572
SSDEEP 768:VMEIvFGvZEr8LFK0ic46N47eSdYAHwmZ7Bp6JXXlaa5uA:VbIvYvZEyFKF6N4yS+AQmZIl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 5c1d8451ad1c8b2b4355860d87fd18e7668fce2ab1d335afc87edbf94ab64bf8
MD5 b6596af3fb9a9acaf3b26959746fabba
SHA1 d03e4b965ab0f7064b28436c33176f7b0bd27f6c
SHA512 ed0b16acaea6680f7a5fa40506f10b2076d0ec9a991864d79d2f8024907f5b30bd778e31a664c51110fd36f5af6967a48cd52e5b96ebcad7ae9fdae5fa890d60
SSDEEP 768:rMEIvFGvZEr8LFK0ic46N47eSdYAHwmZ7Bp6JXXlaa5uA:rbIvYvZEyFKF6N4yS+AQmZIl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 61KB
SHA256 d994ca765f73f3301b9c16cf924c1560fc6e47ecd06385da6fe9669e03947293
MD5 0e0d5ba8bc25f45fe26752206af31ec9
SHA1 0e326bb83f1c22d169892657f18da5d72591cb92
SHA512 39fab97452d9ce3fa5cf2138c7d2a030f87e8549568ed3330a201668f4d98f8d1b1db631b9afe48c196465b956b80225100779eac7fc4aabeeb93e2d1377406a
SSDEEP 768:xMEIvFGvZEr8LFK0ic46N47eSdYAHwmZ7Bp6JXXlaa5uA:xbIvYvZEyFKF6N4yS+AQmZIl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads