neconyd | 67690b50d1b230c33d32822968f5d129c8bbefff48be3e91be13ac4ed005652f

Analysis

max time kernel
142s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 22:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
67690b50d1b230c33d32822968f5d129c8bbefff48be3e91be13ac4ed005652f.exe
Size 73KB
Sample240610-2x62batgnc
SHA256 67690b50d1b230c33d32822968f5d129c8bbefff48be3e91be13ac4ed005652f
MD5 120a709735a2efe13fcf0097cb9ef4db
SHA1 d64d784edd804d0cc2648c1472a7c67bee86c860
SHA512 074e72ffc0e1f795b4d3a387662ae45d504b8b16839a01ee4d350815a5e3fee880b0dd7b641e6de3e6ab345666d088b82a1de1034298cae78adcf90a9163477a
SSDEEP 1536:Hd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:vdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
116	omsecor.exe
5080	omsecor.exe
2508	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 116	3584	67690b50d1b230c33d32822968f5d129c8bbefff48be3e91be13ac4ed005652f.exe	82
PID 3584 wrote to memory of 116	3584	67690b50d1b230c33d32822968f5d129c8bbefff48be3e91be13ac4ed005652f.exe	82
PID 3584 wrote to memory of 116	3584	67690b50d1b230c33d32822968f5d129c8bbefff48be3e91be13ac4ed005652f.exe	82
PID 116 wrote to memory of 5080	116	omsecor.exe	94
PID 116 wrote to memory of 5080	116	omsecor.exe	94
PID 116 wrote to memory of 5080	116	omsecor.exe	94
PID 5080 wrote to memory of 2508	5080	omsecor.exe	95
PID 5080 wrote to memory of 2508	5080	omsecor.exe	95
PID 5080 wrote to memory of 2508	5080	omsecor.exe	95

C:\Users\Admin\AppData\Local\Temp\67690b50d1b230c33d32822968f5d129c8bbefff48be3e91be13ac4ed005652f.exe
"C:\Users\Admin\AppData\Local\Temp\67690b50d1b230c33d32822968f5d129c8bbefff48be3e91be13ac4ed005652f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 73KB
SHA256 2e212e48a7f8d2febefb2a5a99658c326c5e99d36e970e0f6f4123a29ecbb59c
MD5 21314ca480557049db41ac6cd6a2d0fb
SHA1 bfe55001a767c3b314b4f0a97f625a3c8a50f407
SHA512 273441b2bedbe7f6b5ce892883ed33e10e1fbf25cc1e0a0d7ae6598947d8574e46b699af7009511ba2287846c2721b0e4274b69eb3d7566797b270661955a2fd
SSDEEP 1536:Kd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:KdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 73KB
SHA256 cc45e24de7c77d7623f23de2838a4d650bdba3878f7bd2240a132f5919053d6d
MD5 0b93f8471c2a9cdb37761f6fa62030d7
SHA1 27643a599b6fa41c3b19494d9f50659f3fa620f6
SHA512 dbb50a65146bda7b08ae12a3b406b7ab2a317752d2c8c7a28b4c6f9041e910f65dce17d851567569a0ec5473792a31d480860cc23dd8a47f33cdbcfd47c7eb08
SSDEEP 1536:Ed9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:8dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 73KB
SHA256 838090dd40d8dbd2686dddf9e799813afb01c643b9c33377ebbdf4849e084a53
MD5 e6bb642a5cf88c8ba18d1c1b5cefe30e
SHA1 ebac6374ae8ac7f92ee1a907e9887ef41d906339
SHA512 12886ac50cd07fb453e6f1e3b2e9bc11073b9527cde74dcdc290a89bb3990c31d9ebdada6d01571a108808107f2a00ad33b57e335f2e6a73edc99880e17cc994
SSDEEP 1536:ed9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:GdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads