neconyd | 8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db

Analysis

max time kernel
112s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db.exe
Size 72KB
Sample240607-dbpm5shf24
SHA256 8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db
MD5 76719b21d3a43c317d19d98cfd0198a4
SHA1 08be764cbd43e154eee1bf793fae225270eba090
SHA512 cdf6bcd558004d4974d2a2fb5fc64b535286b66fd22ce21d566851e2ea78281710afbd96e0c4207f7047d37cd08e263e35bad5e1871a55488e06c4fd1d967e8a
SSDEEP 768:RMEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:RbIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
1612	omsecor.exe
1928	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 1612	4924	8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db.exe	91
PID 4924 wrote to memory of 1612	4924	8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db.exe	91
PID 4924 wrote to memory of 1612	4924	8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db.exe	91
PID 1612 wrote to memory of 1928	1612	omsecor.exe	101
PID 1612 wrote to memory of 1928	1612	omsecor.exe	101
PID 1612 wrote to memory of 1928	1612	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db.exe
"C:\Users\Admin\AppData\Local\Temp\8916db0633635e5523152d88e1b96d1c02f731e078c32d082e4b03e2555cf8db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    PID:1928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3912 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:2628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 d7b7cc4f319297fb1d60fbf13cc2ed2eab84df002ef93de774b1edff7ee90059
MD5 f78e06af7082b61e1a24b55961124f4e
SHA1 4cf873d3c11fa6d0cd68eccbf52cc72a727a9014
SHA512 cb4b78205a53bd776338170c461e22a99102fee166e4a0ad4e266786df2945dc46c86f19ddc0441ae69f71e295c138e9c8775f102e435769abdf013c7887635b
SSDEEP 768:lMEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:lbIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 72KB
SHA256 8cd3eeaf481d96e6b4ffd63be728bff93faf2b8463acf06cd1b27f384a2321f8
MD5 178047183b60b997b67d0aedf1b062e1
SHA1 07165997def84044d53c8ca52b7dbb84ed7b3065
SHA512 9ac11f64a89da7a047a75dab8b872b65dda4c7662fa0ff0cc6a61cb5165c8a7574bb06323d7ee5cec75c48fda5feb2b41d6c7d1e9564396c48102033423fbbab
SSDEEP 768:8hMEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:8hbIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1612-4-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1612-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1612-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1928-12-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1928-14-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4924-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4924-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads