neconyd | 01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57.exe
Size 72KB
Sample240604-wscc9aeh3x
SHA256 01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57
MD5 8b422824c12d79d038bf455c8133fcd0
SHA1 931bdd38096808d2ff28e6238fa051570a1fa863
SHA512 6016610cff945e82256b5985d9d5398ecf15650c842411c53f4ba15fa1bcd1e46de46e9dccd2efa5b5a17576dcccb845e8c70165cfb5d0ce1270999ca99815d6
SSDEEP 1536:ud9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:2dseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1752	omsecor.exe
2920	omsecor.exe
1340	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1952	01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57.exe
1952	01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57.exe
1752	omsecor.exe
1752	omsecor.exe
2920	omsecor.exe
2920	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1752	1952	01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57.exe	28
PID 1952 wrote to memory of 1752	1952	01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57.exe	28
PID 1952 wrote to memory of 1752	1952	01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57.exe	28
PID 1952 wrote to memory of 1752	1952	01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57.exe	28
PID 1752 wrote to memory of 2920	1752	omsecor.exe	32
PID 1752 wrote to memory of 2920	1752	omsecor.exe	32
PID 1752 wrote to memory of 2920	1752	omsecor.exe	32
PID 1752 wrote to memory of 2920	1752	omsecor.exe	32
PID 2920 wrote to memory of 1340	2920	omsecor.exe	33
PID 2920 wrote to memory of 1340	2920	omsecor.exe	33
PID 2920 wrote to memory of 1340	2920	omsecor.exe	33
PID 2920 wrote to memory of 1340	2920	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57.exe
"C:\Users\Admin\AppData\Local\Temp\01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 9d3c68721100fb5220a00fd8573f09ca2a78ee2388ccb88865ad488b0fcc4d3c
MD5 e04c858ea1cfc5d2631a66696cf7b786
SHA1 4f3be9ad26cbc0ce9443919e1d3036913170452f
SHA512 f4115603e5f5576e0932fd02b68824520265129935f5f9624f1827820f7688dac78eb02bdb0eb6a4acf9298aee0c503a047b7b08bebfc302018526c8e5800df6
SSDEEP 1536:2d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:OdseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 f9b1a0e6929b6737bef222c7ea3101c0525e69213bbb61df4a6431844cfff093
MD5 a40a5410ffc99689778085ae4d89b952
SHA1 40fd71288b7b9c78f93c100cd5133262cca9ca14
SHA512 e4a30ec65c04c4f195380060d03e0b46d76272c4d36bd18a4bf41b62ca87fea174e95bf37360d2b63504150d29429cb489c991786bdddb56f1851093ffcf9320
SSDEEP 1536:cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:kdseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 72KB
SHA256 ee95f88ccf28599b526ef489d2dceff511ad7ffa34d25beed9961900f48ad719
MD5 8e2b338134945c1bcf08a99716158ea5
SHA1 9abf0d014949e4af102e96993d8312b85d5d789b
SHA512 3632dec44719f8bc2dc32ea6cfbe142d404e2b997630e21f0ae970f7d1525b7f29bd017bff975c5404ca53f8d7c93b51df264560f50be581ebb369b21dafda2f
SSDEEP 1536:wd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:wdseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads