neconyd | 634c227bc08b7a01f9f717c8d7787fd16bbf3d3b2df863707953f06da283be7a

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
634c227bc08b7a01f9f717c8d7787fd16bbf3d3b2df863707953f06da283be7a.exe
Size 76KB
Sample240607-ae336aeb3z
SHA256 634c227bc08b7a01f9f717c8d7787fd16bbf3d3b2df863707953f06da283be7a
MD5 e291b65c07c182fd17761b6cd2a9d22d
SHA1 c202ef9a6a2290ae08e357c98c3dd944a20a3712
SHA512 97c2106d56a47505460a890963d3cec7789fd91972f4aa4dc691deca19fbc76e02b48823ed0be94fad2236850fe490a6d052aba7cbe484ca5b62e5b7f1c02b18
SSDEEP 768:1MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:1bIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2996	omsecor.exe
2436	omsecor.exe
5696	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 2996	4728	634c227bc08b7a01f9f717c8d7787fd16bbf3d3b2df863707953f06da283be7a.exe	83
PID 4728 wrote to memory of 2996	4728	634c227bc08b7a01f9f717c8d7787fd16bbf3d3b2df863707953f06da283be7a.exe	83
PID 4728 wrote to memory of 2996	4728	634c227bc08b7a01f9f717c8d7787fd16bbf3d3b2df863707953f06da283be7a.exe	83
PID 2996 wrote to memory of 2436	2996	omsecor.exe	105
PID 2996 wrote to memory of 2436	2996	omsecor.exe	105
PID 2996 wrote to memory of 2436	2996	omsecor.exe	105
PID 2436 wrote to memory of 5696	2436	omsecor.exe	106
PID 2436 wrote to memory of 5696	2436	omsecor.exe	106
PID 2436 wrote to memory of 5696	2436	omsecor.exe	106

C:\Users\Admin\AppData\Local\Temp\634c227bc08b7a01f9f717c8d7787fd16bbf3d3b2df863707953f06da283be7a.exe
"C:\Users\Admin\AppData\Local\Temp\634c227bc08b7a01f9f717c8d7787fd16bbf3d3b2df863707953f06da283be7a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:5696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 6506f80e994415818b933c59fc40f1a6b6edd6c99f1857eae522c239e703f8be
MD5 5ad41cf1ecd4921faba1a00b30416304
SHA1 964d382c78e55e2e0b39e259759ef69b48bf5f15
SHA512 f7bc1e463d392de003dc0b50b8f6e7f0b3c158bd3185d180834b221b0cec79df1ffc20760e9c50e0a2b3a8779ea65514b4fd185df0bb9b1a9e45f261fe30a208
SSDEEP 768:nMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:nbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 31a4b49466d869a0220c494a8268833b2627387010338fb72b02f9745521f4de
MD5 52bc2d634b9faabac5dc63a4c87c2d70
SHA1 97c0b0aa833041cb5c09ac3ad011d8c8a54c6e5e
SHA512 aa2a09efc6eba471e7af26ffefce866f5053c3064e77a5f769f0c2db965bb543d2bb60bb8a96faceeffb2005ec5a2b225f369637af78796f1d00913f886f5ee6
SSDEEP 768:VMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:VbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 b0ce41bcf8e1e4cc4568c6ea648cbbd56cc98f921660f839618041baeede291d
MD5 e2b51e83a266e1701fde1c63cc7da379
SHA1 72c1021a473c6bd54929a7f7f5dfbca94a51405b
SHA512 c08bf61df537c6c3d2ca7c2d2f75f6d7503ffec116f23bc76ad51730d28920c8d574e579734bc0b4e9d6a90d8934e9b161dc0483cf9ac2309fd188f4dd1c9d33
SSDEEP 768:7MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:7bIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads