neconyd | 8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db

Analysis

max time kernel
83s
max time network
156s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db.exe
Size 72KB
Sample240607-dbpm5shf24
SHA256 8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db
MD5 76719b21d3a43c317d19d98cfd0198a4
SHA1 08be764cbd43e154eee1bf793fae225270eba090
SHA512 cdf6bcd558004d4974d2a2fb5fc64b535286b66fd22ce21d566851e2ea78281710afbd96e0c4207f7047d37cd08e263e35bad5e1871a55488e06c4fd1d967e8a
SSDEEP 768:RMEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:RbIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2964	omsecor.exe
2520	omsecor.exe
1836	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1660	8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db.exe
1660	8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db.exe
2964	omsecor.exe
2964	omsecor.exe
2520	omsecor.exe
2520	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2964	1660	8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db.exe	28
PID 1660 wrote to memory of 2964	1660	8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db.exe	28
PID 1660 wrote to memory of 2964	1660	8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db.exe	28
PID 1660 wrote to memory of 2964	1660	8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db.exe	28
PID 2964 wrote to memory of 2520	2964	omsecor.exe	32
PID 2964 wrote to memory of 2520	2964	omsecor.exe	32
PID 2964 wrote to memory of 2520	2964	omsecor.exe	32
PID 2964 wrote to memory of 2520	2964	omsecor.exe	32
PID 2520 wrote to memory of 1836	2520	omsecor.exe	33
PID 2520 wrote to memory of 1836	2520	omsecor.exe	33
PID 2520 wrote to memory of 1836	2520	omsecor.exe	33
PID 2520 wrote to memory of 1836	2520	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db.exe
"C:\Users\Admin\AppData\Local\Temp\8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 e0b9cf53ea680bfdf6742926da629bd07656716a8250816a6f17befac141745a
MD5 1fcc83d90d18affc7b017330f4219b23
SHA1 c480d85a54892a5b3674f9e9e42bc8f77d6eb3e5
SHA512 7dd2a45470850e3698539a74ae214e3307c4933fe0483660b66151bbf6e7e602d0918b51c8f09a751e47e64bb72d09bb524a0205d079d0ffb84f227b48b0a1cd
SSDEEP 768:OMEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:ObIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 d7b7cc4f319297fb1d60fbf13cc2ed2eab84df002ef93de774b1edff7ee90059
MD5 f78e06af7082b61e1a24b55961124f4e
SHA1 4cf873d3c11fa6d0cd68eccbf52cc72a727a9014
SHA512 cb4b78205a53bd776338170c461e22a99102fee166e4a0ad4e266786df2945dc46c86f19ddc0441ae69f71e295c138e9c8775f102e435769abdf013c7887635b
SSDEEP 768:lMEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:lbIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 72KB
SHA256 fcba9e2b46a4623139a71507b323f5ba293d25af6875609d990b1aa32494d0d1
MD5 1ef7217d2c752019f06568ec9db6942e
SHA1 670bbac0f6dbd025fa825999979c8f5ae53eaa0f
SHA512 2cfe03eaa473125f01e0cfb129df9eb61f2df8f163bfbcdcd487b5df2f69233ac27116630362b34f9a0726c238bc16be981fd6dfcedfc9f24365ac94dc13e8b3
SSDEEP 768:aMEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:abIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1660-9-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1660-1-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1836-36-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1836-37-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2520-27-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2964-10-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2964-12-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2964-24-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2964-18-0x00000000020B0000-0x00000000020DB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads