neconyd | 4e05173e058078d3112cec01c8eacc040b73f66c2e522754065a8c10c38a13e1

Analysis

max time kernel
89s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e05173e058078d3112cec01c8eacc040b73f66c2e522754065a8c10c38a13e1.exe
Size 84KB
Sample240606-2wwtysec58
SHA256 4e05173e058078d3112cec01c8eacc040b73f66c2e522754065a8c10c38a13e1
MD5 5aff4b4458cfda84be852c1b4537f69d
SHA1 f8567c60daf7fe250ec9bf7344d508ab5a98bf86
SHA512 74124a21536b4c39931bfdaef0c47bdca710ee00843a95d31ed20662cb34552df6b553f5c08dfa18c103c64b512882dbac55f3ab55f42833367651aa68b5fd47
SSDEEP 768:AMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:AbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1692	omsecor.exe
1504	omsecor.exe
1004	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
620	4e05173e058078d3112cec01c8eacc040b73f66c2e522754065a8c10c38a13e1.exe
620	4e05173e058078d3112cec01c8eacc040b73f66c2e522754065a8c10c38a13e1.exe
1692	omsecor.exe
1692	omsecor.exe
1504	omsecor.exe
1504	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1692	620	4e05173e058078d3112cec01c8eacc040b73f66c2e522754065a8c10c38a13e1.exe	28
PID 620 wrote to memory of 1692	620	4e05173e058078d3112cec01c8eacc040b73f66c2e522754065a8c10c38a13e1.exe	28
PID 620 wrote to memory of 1692	620	4e05173e058078d3112cec01c8eacc040b73f66c2e522754065a8c10c38a13e1.exe	28
PID 620 wrote to memory of 1692	620	4e05173e058078d3112cec01c8eacc040b73f66c2e522754065a8c10c38a13e1.exe	28
PID 1692 wrote to memory of 1504	1692	omsecor.exe	32
PID 1692 wrote to memory of 1504	1692	omsecor.exe	32
PID 1692 wrote to memory of 1504	1692	omsecor.exe	32
PID 1692 wrote to memory of 1504	1692	omsecor.exe	32
PID 1504 wrote to memory of 1004	1504	omsecor.exe	33
PID 1504 wrote to memory of 1004	1504	omsecor.exe	33
PID 1504 wrote to memory of 1004	1504	omsecor.exe	33
PID 1504 wrote to memory of 1004	1504	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\4e05173e058078d3112cec01c8eacc040b73f66c2e522754065a8c10c38a13e1.exe
"C:\Users\Admin\AppData\Local\Temp\4e05173e058078d3112cec01c8eacc040b73f66c2e522754065a8c10c38a13e1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:620
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 cec405de6b520c611ebb158888be3a35cb0a76f0c3c323b5af04726a602c9342
MD5 9fb66e00bdc399f52305dab75ddfc95b
SHA1 6f77632b7dc6deb3a9fe363df361a7da16f84367
SHA512 b781183433c475486e02b408df44b00e726ced5a12bd0ed19f5a03afdd7a3a7451197dd7aa0610265c58b2b83b282fc44c103f086bdefb3f99f0c46786d9e43c
SSDEEP 768:+MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:+bIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 fc3821d7c3a6e62652157d420a4cbab39900a35a87a16d0b0b9eb9c302dc8856
MD5 65a7316c4e0345332dce70f98c0e2f4c
SHA1 b8ae3405b1b0c26edcfe776c6aff956844ecf35f
SHA512 df5887636b573e098bddbf0a66e5896ca401a9833d2451dfceed5516d1ea9ec517f2b9bd756b75a8d98362bb8a8183d64868022da3ffc000ac1109c9da23e1f9
SSDEEP 768:BMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:BbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 80fe64f41fd9253855fae08a45f090f1c71d1045e57eae9bb9a1c11aefce2163
MD5 2267799a5e384d638fb58b7bf50d4af6
SHA1 21431347713f37528b30b3f46ade66aafdd3b6f1
SHA512 b3cf0a9e460a76ed3262e53f0a9e52b55073868298d531ef99a54331bb8ef9fdaa1a085c28d2fc3321d7bb1090b56b9272f65d86e46517e21fd483eea9885616
SSDEEP 768:YMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:YbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads