neconyd | 4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf.exe
Size 62KB
Sample240606-2mlmmaeb67
SHA256 4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf
MD5 02fb4df2fe110f36997333c4f9b36977
SHA1 6910aa2ea1ac961f9842efa819df10f7df7b44ed
SHA512 7006886a28ffd40edfebc2ea7a4af87fe1c7e76a58027c8a2df3e593e42f4f677a4a71bfe0e534ccce2c8447cd8d32c81680963e64f79cb65010f3c8cf02db8e
SSDEEP 768:gMEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:gbIvYvZEyFKF6N4yS+AQmZtl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1556	omsecor.exe
4924	omsecor.exe
3036	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1556	2928	4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf.exe	83
PID 2928 wrote to memory of 1556	2928	4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf.exe	83
PID 2928 wrote to memory of 1556	2928	4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf.exe	83
PID 1556 wrote to memory of 4924	1556	omsecor.exe	105
PID 1556 wrote to memory of 4924	1556	omsecor.exe	105
PID 1556 wrote to memory of 4924	1556	omsecor.exe	105
PID 4924 wrote to memory of 3036	4924	omsecor.exe	106
PID 4924 wrote to memory of 3036	4924	omsecor.exe	106
PID 4924 wrote to memory of 3036	4924	omsecor.exe	106

C:\Users\Admin\AppData\Local\Temp\4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf.exe
"C:\Users\Admin\AppData\Local\Temp\4a31a97e07067d646757c4427907e54b6e22aff6941cd0a73ffc9c823556c0cf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 62KB
SHA256 0f7d615eafff6694b9740229cb2cbe180b54897c4eee853bcfbd4e78274de5c9
MD5 070bdb3bada8a5d31d7daa1aaef1e41d
SHA1 7d53666663ddca5f24481d4c229a4b50d3c73e7d
SHA512 25d66e116931e6f8becb15377ac256fb329f755eef9881a0e8a52087d3e7ac456db0a5b7d43ae0d3516e615f9e7b929b8705a5a2a95c96ca118d6bd73f639977
SSDEEP 768:MMEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:MbIvYvZEyFKF6N4yS+AQmZtl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 62KB
SHA256 9d873fd16a49ae5f6f6a8ee03935d73febeb634162306b31d6631ca9970680c8
MD5 9317ad22564c9895f53c3bcc15009269
SHA1 937bc3f029171e24f4c6b07411026d45f7634a7d
SHA512 f49b452996e6837c794de73c2926b8fb0dba162258d7b4da949e7f3a39ec9878981d85f813fb76dc2c593484225b137d9139162c59985993f82732883b11bd4e
SSDEEP 768:IMEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:IbIvYvZEyFKF6N4yS+AQmZtl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 62KB
SHA256 0894369d4177033eacbfc0f7b21ae2b6f4d0dd3c2555d7b876e8ee2b7d665bb7
MD5 d484b81c4aa4d662976f51c2343bd8c6
SHA1 3160a473e956d6bef186f7d899e57a1ad80bb511
SHA512 1f68f2cb0682e2c3ebc20c20e552b85b7519cb875556fdf3abddc264c12cade5f20a227aad354d65b9af4e9b31ca70826db8d241a876a2ddf1802ba9357f1de5
SSDEEP 768:kMEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:kbIvYvZEyFKF6N4yS+AQmZtl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads