neconyd | 7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe
Size 64KB
Sample240610-312rfawckb
SHA256 7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783
MD5 d01bdc61014bed84f6caeec86134c1e2
SHA1 37b704faae2ddd049b38ce47bfb85e0d097343e7
SHA512 ff47d9ad6eacda1c81b0da178d361e064da8261517ed226a4c33cf01616a7a236acf8556f9bb398a9cc9ae6a97e362e09c32ff1fdd6f4cb92abfdbc473bfac4d
SSDEEP 768:GMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:GbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1408	omsecor.exe
2452	omsecor.exe
1744	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1408	1388	7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe	81
PID 1388 wrote to memory of 1408	1388	7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe	81
PID 1388 wrote to memory of 1408	1388	7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe	81
PID 1408 wrote to memory of 2452	1408	omsecor.exe	90
PID 1408 wrote to memory of 2452	1408	omsecor.exe	90
PID 1408 wrote to memory of 2452	1408	omsecor.exe	90
PID 2452 wrote to memory of 1744	2452	omsecor.exe	91
PID 2452 wrote to memory of 1744	2452	omsecor.exe	91
PID 2452 wrote to memory of 1744	2452	omsecor.exe	91

C:\Users\Admin\AppData\Local\Temp\7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe
"C:\Users\Admin\AppData\Local\Temp\7fa25de9f2d9f7b945190abfc015f132f11371c6f3d0fe057194976833a72783.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 d3bc710d078f05ce7c09fcb186ce57f313b8fb7990ee914dee8dd8f2901bb773
MD5 968955cee8159b2ce0c7b8d9d0197ab6
SHA1 e8c524b470bcbb5b9c6cf5fbc21a0507f96a7987
SHA512 0f19688026164d78cd485b04fb22c760dd0ed91fc0b9495863e9da9ab4f6dbed7a1ceaee62cb3cfed245b928d906e2eac3d1ea8144afa4b3e8cd2e9712ec5eb1
SSDEEP 768:8MEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:8bIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 a9d7ebc6e89dc13d73884fa876ea7c076faa170342dc11d361db45d77a35b1e2
MD5 fa1cd327b18f11b1040f9e725b078eb3
SHA1 6109e49352ac8c49aa2b0a0a8e6127dee8bf6e5d
SHA512 101cb6333da3dffc135c97dee3cbd6f54bbde0348df425f89e16f2549efa4e8543cee99ae8e62cd64accd9bf5f82e4420f41eab6c2964ddb39cdae7c28e7f231
SSDEEP 768:CMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:CbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 64KB
SHA256 7027f337c74206c20e3a2ecd74c99b0598cd526b50cf79f91efd4980efb598f4
MD5 3e1929c7b7c659bdfd8a9d54928ee96b
SHA1 59ea9e04c3c8fa81857ea916064d6885c31079de
SHA512 d84ab811b925a4832bd05f844eee18b85f7473ecf8929ad1ca15fc0af09014582d800e21111d6ee8f4e7848269fc02f5ee4bf68c3c55f461cce8fa28d5888673
SSDEEP 768:cMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:cbIvYvZEyFKF6N4yS+AQmZcl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads