neconyd | 01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57.exe
Size 72KB
Sample240604-wscc9aeh3x
SHA256 01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57
MD5 8b422824c12d79d038bf455c8133fcd0
SHA1 931bdd38096808d2ff28e6238fa051570a1fa863
SHA512 6016610cff945e82256b5985d9d5398ecf15650c842411c53f4ba15fa1bcd1e46de46e9dccd2efa5b5a17576dcccb845e8c70165cfb5d0ce1270999ca99815d6
SSDEEP 1536:ud9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:2dseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1596	omsecor.exe
3808	omsecor.exe
4080	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1596	2232	01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57.exe	84
PID 2232 wrote to memory of 1596	2232	01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57.exe	84
PID 2232 wrote to memory of 1596	2232	01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57.exe	84
PID 1596 wrote to memory of 3808	1596	omsecor.exe	93
PID 1596 wrote to memory of 3808	1596	omsecor.exe	93
PID 1596 wrote to memory of 3808	1596	omsecor.exe	93
PID 3808 wrote to memory of 4080	3808	omsecor.exe	94
PID 3808 wrote to memory of 4080	3808	omsecor.exe	94
PID 3808 wrote to memory of 4080	3808	omsecor.exe	94

C:\Users\Admin\AppData\Local\Temp\01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57.exe
"C:\Users\Admin\AppData\Local\Temp\01ba89fcee616b54111283f8cff8d55a85f850ea33fa2fa82d3d3141242c1b57.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 9d3c68721100fb5220a00fd8573f09ca2a78ee2388ccb88865ad488b0fcc4d3c
MD5 e04c858ea1cfc5d2631a66696cf7b786
SHA1 4f3be9ad26cbc0ce9443919e1d3036913170452f
SHA512 f4115603e5f5576e0932fd02b68824520265129935f5f9624f1827820f7688dac78eb02bdb0eb6a4acf9298aee0c503a047b7b08bebfc302018526c8e5800df6
SSDEEP 1536:2d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:OdseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 5a93bb80e54ec3bff60f11d44e14e0858d7f2f170094a75ebfe3a9342b1958a0
MD5 31b2e1c0ad870710879537e9d6d97610
SHA1 2307369fadd133d5af9f2c3a40caa9a4e3ae5d6c
SHA512 335d0eb02f916c47f82600d4adc4715739ec8c041d64f4800d913adad1b93c25fd12480a9f072affa7feb556b7f36d4956f56c0fb6c6e86cb0c45b316486d6b3
SSDEEP 1536:dd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:VdseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 72KB
SHA256 b4abd5bd60bced1399c93d2f950d9005c7e1347cb12210894408c99a1acc0ea7
MD5 a0ea1f2b378aee5c19a3e9bfbaee28fe
SHA1 0f81f4ced16622eaa815deb4442dd98dcea12276
SHA512 e8098ea837cf11cfe441ca941948bd6d9431e3d16e7d6207367da0e148aa451c2778ff1fc7cfffbc4629ed34a11c3d513848fe2807cf8a0716310c7b8ecc7276
SSDEEP 1536:Rd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:hdseIOMEZEyFjEOFqTiQm5l/5211
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads