neconyd | f45b24e4350166f4b4fe231ad2e2bd0634a864e798901a3b73fb78b50aa4f110

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 09:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f45b24e4350166f4b4fe231ad2e2bd0634a864e798901a3b73fb78b50aa4f110.exe
Size 76KB
Sample240607-k8mndafb65
SHA256 f45b24e4350166f4b4fe231ad2e2bd0634a864e798901a3b73fb78b50aa4f110
MD5 34c59f23917c01c23d19e09e7c25af58
SHA1 85a98c43bcff022dca6802e132a2c275d87bf81c
SHA512 303edc44e2bb63c32801c7aa73bc81e0c69089251319a59d4a8998fd561507d8383833a3a124e4a4b0f749e3cf7a5be755bdf5ef36fb5654c4422404d0cb5c29
SSDEEP 1536:Sd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:idseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1608	omsecor.exe
3648	omsecor.exe
1736	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 1608	2620	f45b24e4350166f4b4fe231ad2e2bd0634a864e798901a3b73fb78b50aa4f110.exe	82
PID 2620 wrote to memory of 1608	2620	f45b24e4350166f4b4fe231ad2e2bd0634a864e798901a3b73fb78b50aa4f110.exe	82
PID 2620 wrote to memory of 1608	2620	f45b24e4350166f4b4fe231ad2e2bd0634a864e798901a3b73fb78b50aa4f110.exe	82
PID 1608 wrote to memory of 3648	1608	omsecor.exe	103
PID 1608 wrote to memory of 3648	1608	omsecor.exe	103
PID 1608 wrote to memory of 3648	1608	omsecor.exe	103
PID 3648 wrote to memory of 1736	3648	omsecor.exe	104
PID 3648 wrote to memory of 1736	3648	omsecor.exe	104
PID 3648 wrote to memory of 1736	3648	omsecor.exe	104

C:\Users\Admin\AppData\Local\Temp\f45b24e4350166f4b4fe231ad2e2bd0634a864e798901a3b73fb78b50aa4f110.exe
"C:\Users\Admin\AppData\Local\Temp\f45b24e4350166f4b4fe231ad2e2bd0634a864e798901a3b73fb78b50aa4f110.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 163815f5c874a4cd18a6ea1fe0da8b4a15fef5127d3607c78a76e23b6a990d5a
MD5 4ea511062db846a54d043046baf94275
SHA1 448e7270ee75887aa4debba36e53c7d2c230e43e
SHA512 0daaa5c44ad46d793d3fdf0f99da77f26edf09b4f6d92efc62fba2d0814b260d6201cd11a04ff1581c7b1d6ac8e3cef61b7da8537fff4043a63e8db689be02da
SSDEEP 1536:xd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:BdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 b3983cb335683b4d10e259f70b9067005105ce377adbf7c2eec806753c8205f7
MD5 c00c1751d159291780fda16a4ae75100
SHA1 b12cae5da5d188c9f8a09aa021615feb023c8887
SHA512 a4bc8065a488c978492a74820c6e2cf5431b226edcd5ecec3bcb2f432a79faeb2d7f946999c2315e1a12582e2c9fb64dba8f5bc80a4c0cc0cef0c4d63290cb7f
SSDEEP 1536:hd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:RdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 3fcefce56b8fe8903e7ecfab2c81a621b4157fc1b06fad3a0fd4f5c6ee3021d4
MD5 1d0286023434011d8a80605dd7842384
SHA1 c28684131f6e9fd4736fc536fa18a76a601cb060
SHA512 14554fe5aa1be57b3d2732079526e7a0d3755cde64084f3298eaf8c706099a05b52af66b916f487483250878758ba87bd148f7012f04c0037df4536923a53a16
SSDEEP 1536:wd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:wdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1608-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1608-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1608-12-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1736-17-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1736-19-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2620-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2620-4-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3648-14-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads