neconyd | 0b59a512c07f69ec8c8637d052cc805467cb9ed363b70fbb044111b6bd90e037

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b59a512c07f69ec8c8637d052cc805467cb9ed363b70fbb044111b6bd90e037.exe
Size 88KB
Sample240608-xfmtwsfd79
SHA256 0b59a512c07f69ec8c8637d052cc805467cb9ed363b70fbb044111b6bd90e037
MD5 f12150af1f5789320174b7c3e9ce946e
SHA1 76015b2593ca3655e5403fd439a274d4a068fd7a
SHA512 76eeaffc13be106c9d7614853a9ca5330f826a06c626730d0b325a4be04b0c2d21e627f9f49dca5ff71e3fe953157483e9bc6141aeb60fc26fbbb669fed49f0a
SSDEEP 768:LMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:LbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4688	omsecor.exe
4472	omsecor.exe
4984	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 4688	3800	0b59a512c07f69ec8c8637d052cc805467cb9ed363b70fbb044111b6bd90e037.exe	84
PID 3800 wrote to memory of 4688	3800	0b59a512c07f69ec8c8637d052cc805467cb9ed363b70fbb044111b6bd90e037.exe	84
PID 3800 wrote to memory of 4688	3800	0b59a512c07f69ec8c8637d052cc805467cb9ed363b70fbb044111b6bd90e037.exe	84
PID 4688 wrote to memory of 4472	4688	omsecor.exe	96
PID 4688 wrote to memory of 4472	4688	omsecor.exe	96
PID 4688 wrote to memory of 4472	4688	omsecor.exe	96
PID 4472 wrote to memory of 4984	4472	omsecor.exe	97
PID 4472 wrote to memory of 4984	4472	omsecor.exe	97
PID 4472 wrote to memory of 4984	4472	omsecor.exe	97

C:\Users\Admin\AppData\Local\Temp\0b59a512c07f69ec8c8637d052cc805467cb9ed363b70fbb044111b6bd90e037.exe
"C:\Users\Admin\AppData\Local\Temp\0b59a512c07f69ec8c8637d052cc805467cb9ed363b70fbb044111b6bd90e037.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 60668113bcbba06b4e1989bfe068ca8df048058cdf4fa9f3afa3f8c99848380e
MD5 d6b406b9ea5f47d2047c801dcff9dadf
SHA1 9c6b65f3c760ebe503c4802997bf9535bdeebbf1
SHA512 908e2c2409465556e8a110df86d817c35d6683e0e10d7104d37a82ade2ccc3d2f79d36a3b937c2a005aacf400bd0f3e2564478cbcb7cb4a066f707f4ec2baca1
SSDEEP 768:yMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:ybIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 0b5f1d2ce29116e681a9a1359d6db9422ed499b10a63ee014a149db878c1d8ad
MD5 7cb6ee44d59d03a7e8ac45a05f294aec
SHA1 9f42ae863b74b5c0889728132c42df0432c2c02d
SHA512 7c8ad067c8b4d3e961ac836f46e7aac8d47f746ec3b168416101d44639a69e706167511ff699fc99987167328122a3b4b3659fdf3f283eea77de86506bf38dee
SSDEEP 768:cMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:cbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 f47c88c46642559f23acd86656ac25ba19a10e0284db0d32abc0afee36c2a323
MD5 4d064413375039c4c3eeba2786b4f8ed
SHA1 0f5b614495943b09e62b4d6bbf37cbbb0ae04dcc
SHA512 ebcf64ced91df862f4a9e171dd57370a2292f9d6665bdce4084b31a281e02d02d665a30f5210c328282e0b0793d0a6df1151895665fb2e18657e07bac7425b82
SSDEEP 768:uMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:ubIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads