neconyd | 4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf.exe
Size 62KB
Sample240606-2mlmmaeb67
SHA256 4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf
MD5 02fb4df2fe110f36997333c4f9b36977
SHA1 6910aa2ea1ac961f9842efa819df10f7df7b44ed
SHA512 7006886a28ffd40edfebc2ea7a4af87fe1c7e76a58027c8a2df3e593e42f4f677a4a71bfe0e534ccce2c8447cd8d32c81680963e64f79cb65010f3c8cf02db8e
SSDEEP 768:gMEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:gbIvYvZEyFKF6N4yS+AQmZtl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2384	omsecor.exe
1700	omsecor.exe
1752	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2180	4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf.exe
2180	4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf.exe
2384	omsecor.exe
2384	omsecor.exe
1700	omsecor.exe
1700	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2384	2180	4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf.exe	28
PID 2180 wrote to memory of 2384	2180	4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf.exe	28
PID 2180 wrote to memory of 2384	2180	4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf.exe	28
PID 2180 wrote to memory of 2384	2180	4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf.exe	28
PID 2384 wrote to memory of 1700	2384	omsecor.exe	32
PID 2384 wrote to memory of 1700	2384	omsecor.exe	32
PID 2384 wrote to memory of 1700	2384	omsecor.exe	32
PID 2384 wrote to memory of 1700	2384	omsecor.exe	32
PID 1700 wrote to memory of 1752	1700	omsecor.exe	33
PID 1700 wrote to memory of 1752	1700	omsecor.exe	33
PID 1700 wrote to memory of 1752	1700	omsecor.exe	33
PID 1700 wrote to memory of 1752	1700	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf.exe
"C:\Users\Admin\AppData\Local\Temp\4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 62KB
SHA256 9d873fd16a49ae5f6f6a8ee03935d73febeb634162306b31d6631ca9970680c8
MD5 9317ad22564c9895f53c3bcc15009269
SHA1 937bc3f029171e24f4c6b07411026d45f7634a7d
SHA512 f49b452996e6837c794de73c2926b8fb0dba162258d7b4da949e7f3a39ec9878981d85f813fb76dc2c593484225b137d9139162c59985993f82732883b11bd4e
SSDEEP 768:IMEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:IbIvYvZEyFKF6N4yS+AQmZtl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 62KB
SHA256 03e7ca2432b4fe68ba73a7913a8a5847653424fd97780bf8c546f2648af1b223
MD5 489374059da9cb72ae3697cc1299d117
SHA1 e7b9fd0a44da45f41b28b35fa70f3d6f9259e75c
SHA512 8b90b398c29948ad5dc66c5453d0cd543bf46d866c154cd35036154f4a366bbd3c2d4b01691f2fce77bbcdc56889aac363a4a9fd36d3bb9303e92bcbaf8bdfb1
SSDEEP 768:3MEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:3bIvYvZEyFKF6N4yS+AQmZtl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 62KB
SHA256 e1d110bdaf0b228ee2ae37efb35066b194246f1c9e549cbb388a8cbb2f7a7f41
MD5 f5a2da946ecbcea9e1e414cb4f50979a
SHA1 47fbdfbd52ec2adaa631c1c5a9808631731e11eb
SHA512 7140707829b511bfbe9867228b1a7ab9af79cf11f0173fc7862177d9ceb273cddbd8a8a060dde2cf2d3592c78c7760c5f8a6c9398ff1b880214c4caf5ca61643
SSDEEP 768:/MEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:/bIvYvZEyFKF6N4yS+AQmZtl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads