neconyd | 163a9042143f36b5d5f27a3b5fe700c7f7aec075c43528cf0d205b8d981b8e83

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
163a9042143f36b5d5f27a3b5fe700c7f7aec075c43528cf0d205b8d981b8e83.exe
Size 76KB
Sample240605-xv1pasfa7x
SHA256 163a9042143f36b5d5f27a3b5fe700c7f7aec075c43528cf0d205b8d981b8e83
MD5 25b1e68b054ef2b00c01d8289c474471
SHA1 01f7e0b7e2c16dcd921f5bec229f4132b812fef8
SHA512 c6a25a3a70e542489f3767f208909fbb10bdefb4e5b20e7731fa9866d2fa1df867c2dff65a0ad41fdbcdee9b735bcd15820eebc5d2d69271b79b60293e19f926
SSDEEP 768:JMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:JbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1724	omsecor.exe
1580	omsecor.exe
1660	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1724	2508	163a9042143f36b5d5f27a3b5fe700c7f7aec075c43528cf0d205b8d981b8e83.exe	83
PID 2508 wrote to memory of 1724	2508	163a9042143f36b5d5f27a3b5fe700c7f7aec075c43528cf0d205b8d981b8e83.exe	83
PID 2508 wrote to memory of 1724	2508	163a9042143f36b5d5f27a3b5fe700c7f7aec075c43528cf0d205b8d981b8e83.exe	83
PID 1724 wrote to memory of 1580	1724	omsecor.exe	99
PID 1724 wrote to memory of 1580	1724	omsecor.exe	99
PID 1724 wrote to memory of 1580	1724	omsecor.exe	99
PID 1580 wrote to memory of 1660	1580	omsecor.exe	100
PID 1580 wrote to memory of 1660	1580	omsecor.exe	100
PID 1580 wrote to memory of 1660	1580	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\163a9042143f36b5d5f27a3b5fe700c7f7aec075c43528cf0d205b8d981b8e83.exe
"C:\Users\Admin\AppData\Local\Temp\163a9042143f36b5d5f27a3b5fe700c7f7aec075c43528cf0d205b8d981b8e83.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1580
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 ac22eaa99f99f007912a3bda41bc144d05a0d51547ab5295378d5bfc7fcafbd3
MD5 eef04b53db60a77748b44b43d7e89afd
SHA1 db67f4076499f72a29ea87abb764ed8514fc3f14
SHA512 2f36e2c626f835ea54ef8451852de92a246c6a2aa89d6608b96311e5100f0e1569d7e7ece0a9e070feaa5560f2e33579211cdf793bc930c668539bb900cff619
SSDEEP 768:NMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:NbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 758e810096c506c374b7f9795f3e705d5e1361c4ed3f09afbab9feca916b01b4
MD5 fea1e26ad9f4cbc081cbba992e6eb40e
SHA1 01040fc783566a00f42b32687aeb5e871d834f8c
SHA512 9bf37528d904763969225f5f9d2d0b9ffa8d5cff600c724dc56c77d7bb00a0c0163f920a9c78d1f6a516908e3969cf0d1a0b6957277d32bf90bb67878c4b503a
SSDEEP 768:BMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:BbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 9cc229a27a3c0387ff26c2da82c4deccaeed9a12b329f90feb01fa3355bf6aa3
MD5 336f3fc9360c3b6dcfa04ff64782ecdf
SHA1 83291c014c503ca4ad9a0310c0e68c95d392eb5d
SHA512 25f7974c47cd49c57042bac8ba9e8ebc326fca1659c8ea5b041a958f671c0cfcc9a680f708ba55fd01404b1121a4693866391856b2a30d2625a916ddee27f1ba
SSDEEP 768:VMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:VbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads