neconyd | 09f9a99bb03e3a2cdca8c7853129cd24521d2a1b6415db8f37123ed10b100094

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
09f9a99bb03e3a2cdca8c7853129cd24521d2a1b6415db8f37123ed10b100094.exe
Size 76KB
Sample240604-w4n67afd4y
SHA256 09f9a99bb03e3a2cdca8c7853129cd24521d2a1b6415db8f37123ed10b100094
MD5 8f735c4dc6a6a37adc058ff66820dbf8
SHA1 9475a7e05e135eb948eaed85134feefd91e0b077
SHA512 cc6ee56977ec410c6b83404d65d5d65c3f774fddfb3f16bdf8a49cf8371a1f1e2b3c84cc82f4580da1fe796b030451da1a998b3d5d3fc0e5009597296cbbe2c7
SSDEEP 1536:3d9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:/dseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
648	omsecor.exe
1432	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 648	4400	09f9a99bb03e3a2cdca8c7853129cd24521d2a1b6415db8f37123ed10b100094.exe	91
PID 4400 wrote to memory of 648	4400	09f9a99bb03e3a2cdca8c7853129cd24521d2a1b6415db8f37123ed10b100094.exe	91
PID 4400 wrote to memory of 648	4400	09f9a99bb03e3a2cdca8c7853129cd24521d2a1b6415db8f37123ed10b100094.exe	91
PID 648 wrote to memory of 1432	648	omsecor.exe	101
PID 648 wrote to memory of 1432	648	omsecor.exe	101
PID 648 wrote to memory of 1432	648	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\09f9a99bb03e3a2cdca8c7853129cd24521d2a1b6415db8f37123ed10b100094.exe
"C:\Users\Admin\AppData\Local\Temp\09f9a99bb03e3a2cdca8c7853129cd24521d2a1b6415db8f37123ed10b100094.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:648
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:1432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1404 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:4216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 6dd21eb2b4f3873f7632d00ac866fae3f91fe13e63b4fdfbc1b30f04576f22ab
MD5 21ef82a75282a36dace5454881ac651f
SHA1 0238051aa05cc346ede317827eeaf05252c45bbe
SHA512 e4d430a3ae5fb48f08bc142546bc9247ccecaa725880fa1041638e394969b317337c172d8ad4df0e83d2632a331675ab7f7adb8a915fe3d1adbd0c6f907373c5
SSDEEP 1536:fd9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:XdseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 f5cd719b9db346ac511ef289f25bbf69d0a842f09ed5e2f596e4f56f7160d91d
MD5 7ccbaa8fc1895cf64e5308c3031a7655
SHA1 2ead1509dabae904fa0c119d024e8e7f3cb76fbe
SHA512 5843d3b1605c4e14ccb7f903a2b04c367c8eb69de60088aaf6d1a08453441eab45dbf003db4ce05e95ed6b10f5598a1a7b97746d3c2e2687f3d767a645d3ed25
SSDEEP 1536:Ed9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:8dseIOKEZEyF6EOFqTiQm5l/5s11
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/648-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/648-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/648-13-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1432-11-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1432-14-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4400-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4400-6-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads