neconyd | 5690e277e56ecbbd0701366636b511715ece839feaab593a38a0d48ec3bdad69

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5690e277e56ecbbd0701366636b511715ece839feaab593a38a0d48ec3bdad69.exe
Size 92KB
Sample240608-3vb9laac8y
SHA256 5690e277e56ecbbd0701366636b511715ece839feaab593a38a0d48ec3bdad69
MD5 9fcffd8c288108ea541c8845aab398cf
SHA1 79e9f5369930dd74b9a69af9a795ab8f4bc16fe7
SHA512 49ff20163d431f26d3eab07a0e4fd69f0b8d41507305100f483271999b8816a2e3bec10b1ca4f49bcd46eb0e49b320fefc7bb5d9126abe887d440297e2e22465
SSDEEP 768:3MEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:3bIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
3656	omsecor.exe
3464	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 3656	3364	5690e277e56ecbbd0701366636b511715ece839feaab593a38a0d48ec3bdad69.exe	89
PID 3364 wrote to memory of 3656	3364	5690e277e56ecbbd0701366636b511715ece839feaab593a38a0d48ec3bdad69.exe	89
PID 3364 wrote to memory of 3656	3364	5690e277e56ecbbd0701366636b511715ece839feaab593a38a0d48ec3bdad69.exe	89
PID 3656 wrote to memory of 3464	3656	omsecor.exe	99
PID 3656 wrote to memory of 3464	3656	omsecor.exe	99
PID 3656 wrote to memory of 3464	3656	omsecor.exe	99

C:\Users\Admin\AppData\Local\Temp\5690e277e56ecbbd0701366636b511715ece839feaab593a38a0d48ec3bdad69.exe
"C:\Users\Admin\AppData\Local\Temp\5690e277e56ecbbd0701366636b511715ece839feaab593a38a0d48ec3bdad69.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3780 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:2268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 92aad438f3ed97b0902fa179d086365440228d6d9e1062a3d8c0bcf4516a99fe
MD5 9d9aa122962490d224d482fa5399d3ae
SHA1 916388a7d08cd2e519033d7f172391a512cf9272
SHA512 e7a9234abce8c5d8f365abba26318831f435ff7b28c7a81f14f4838f72994838a049452b029718b2f725e41334feebcb6fb085b42cd14defa9ed8c14416b51bb
SSDEEP 768:3MEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:3bIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 92KB
SHA256 40e318c06878398e88c25099cc3e39b6301e61f2d8b9983626b9cafa4de4600e
MD5 c90eff8542fab414f099dd6c9d4510dc
SHA1 3cb783e53e00c3e18721eab376906fa568a88c5e
SHA512 f1baa99c77b18efb3d67e25ef6a550fadccb945d347dda32e2bf366fc31afa2c9841c4ecac2481cdab4b3a2ce1b856249daedc57bda54411d68bb695291b0a0a
SSDEEP 768:JMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:JbIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3364-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3364-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3464-11-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3464-14-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3656-4-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3656-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3656-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads