neconyd | 9b1949249a73060bdcba37b557cea88dba2c96904fac66309c48239a3273b291

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b1949249a73060bdcba37b557cea88dba2c96904fac66309c48239a3273b291.exe
Size 64KB
Sample240604-azma5sfa5w
SHA256 9b1949249a73060bdcba37b557cea88dba2c96904fac66309c48239a3273b291
MD5 62cbafc3869e89f8d5c357e4a3ab1032
SHA1 510cd4376ee50ef2e2d8e67801fd2656bce8d096
SHA512 e515abf077c9e9ef98a17387681164a6935440019896b95017adc3ecccf6a2c5154a896ebbc5c855a21db22b7a50571e7c15c830b7007eafa89a10d9b7cd20ff
SSDEEP 768:8MEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:8bIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1060	omsecor.exe
1204	omsecor.exe
1728	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 1060	3024	9b1949249a73060bdcba37b557cea88dba2c96904fac66309c48239a3273b291.exe	83
PID 3024 wrote to memory of 1060	3024	9b1949249a73060bdcba37b557cea88dba2c96904fac66309c48239a3273b291.exe	83
PID 3024 wrote to memory of 1060	3024	9b1949249a73060bdcba37b557cea88dba2c96904fac66309c48239a3273b291.exe	83
PID 1060 wrote to memory of 1204	1060	omsecor.exe	101
PID 1060 wrote to memory of 1204	1060	omsecor.exe	101
PID 1060 wrote to memory of 1204	1060	omsecor.exe	101
PID 1204 wrote to memory of 1728	1204	omsecor.exe	102
PID 1204 wrote to memory of 1728	1204	omsecor.exe	102
PID 1204 wrote to memory of 1728	1204	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\9b1949249a73060bdcba37b557cea88dba2c96904fac66309c48239a3273b291.exe
"C:\Users\Admin\AppData\Local\Temp\9b1949249a73060bdcba37b557cea88dba2c96904fac66309c48239a3273b291.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 747219d25bcc5e65ed3bc5ea2f87168bd09714e1c5ce5478da9ae036c8fb527e
MD5 ce677fef6b62a7a3d8d0eba29d890493
SHA1 c774c321eedd6c45eaea4815c638994f34a2aff6
SHA512 44a900a9c3b5251c2466e4c9240ed2eb709991db03aa3ca9d607fd2555c3d9359b345959c2295c291c4654e6433fffc7640d76ffe49ab0b03d4d55e41d51b26a
SSDEEP 768:1MEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:1bIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 7da33d881c79eb02fa4a193f869b34f023fe46dd099db20bf203d2c2ddee4fb5
MD5 92823a3f72677f576a5109ffc10126a4
SHA1 e3de3b49f155d53079149950de64e80547e37a1c
SHA512 0353f65d0957dc504a5730c28897f5628cd9671162b1f260729c302bd65386cc64ad2296f60700d35fb58a2410011f64957929be07c43a7b475142f6d1dadaca
SSDEEP 768:EMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:EbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 64KB
SHA256 720e2f7f6b55d096d7f331ec8e02c4c0c9d0b29c1d3188d513ce19a77639e2ac
MD5 7c17c0af075419f10f6d3092327ecefa
SHA1 4538c8c8aa828d2a9a0aa4c5360aaf581b32d050
SHA512 e8d7d1188383516ee813be66a1136ecf1671116e8528a44678dbf149e47848d5e6ee2c66b05dda3ad6969cc6343b73f8a7afe9694fb602c7d158a752abd6f7fb
SSDEEP 768:RMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:RbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads