neconyd | 57b5e6517c83528b9409b2a901754f00a72315d40905bf84b51ed65bfbd84422

Analysis

max time kernel
146s
max time network
155s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
57b5e6517c83528b9409b2a901754f00a72315d40905bf84b51ed65bfbd84422.exe
Size 76KB
Sample240610-pj7dpsvgpn
SHA256 57b5e6517c83528b9409b2a901754f00a72315d40905bf84b51ed65bfbd84422
MD5 47bfd1f376ff8c2e25cfd322095986e8
SHA1 b68e51db856a0aeb8992c3e965ebc3030049c1db
SHA512 adbaa4226d0478b507af54a2ee329995eda23165f90d3c4a856b62773df5f8017668c75bec55441957f44e19753dfb445ee6260ae2029f0a16f1bd2ae4f9f754
SSDEEP 1536:Rd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:hdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1704	omsecor.exe
2428	omsecor.exe
1616	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2848	57b5e6517c83528b9409b2a901754f00a72315d40905bf84b51ed65bfbd84422.exe
2848	57b5e6517c83528b9409b2a901754f00a72315d40905bf84b51ed65bfbd84422.exe
1704	omsecor.exe
1704	omsecor.exe
2428	omsecor.exe
2428	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1704	2848	57b5e6517c83528b9409b2a901754f00a72315d40905bf84b51ed65bfbd84422.exe	28
PID 2848 wrote to memory of 1704	2848	57b5e6517c83528b9409b2a901754f00a72315d40905bf84b51ed65bfbd84422.exe	28
PID 2848 wrote to memory of 1704	2848	57b5e6517c83528b9409b2a901754f00a72315d40905bf84b51ed65bfbd84422.exe	28
PID 2848 wrote to memory of 1704	2848	57b5e6517c83528b9409b2a901754f00a72315d40905bf84b51ed65bfbd84422.exe	28
PID 1704 wrote to memory of 2428	1704	omsecor.exe	32
PID 1704 wrote to memory of 2428	1704	omsecor.exe	32
PID 1704 wrote to memory of 2428	1704	omsecor.exe	32
PID 1704 wrote to memory of 2428	1704	omsecor.exe	32
PID 2428 wrote to memory of 1616	2428	omsecor.exe	33
PID 2428 wrote to memory of 1616	2428	omsecor.exe	33
PID 2428 wrote to memory of 1616	2428	omsecor.exe	33
PID 2428 wrote to memory of 1616	2428	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\57b5e6517c83528b9409b2a901754f00a72315d40905bf84b51ed65bfbd84422.exe
"C:\Users\Admin\AppData\Local\Temp\57b5e6517c83528b9409b2a901754f00a72315d40905bf84b51ed65bfbd84422.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 932f73329696afe721b20488e4abfedf5bce1a89f2d371b6f9bdfc52abd0f95f
MD5 357347451a957aac0f834665521b215b
SHA1 7598305ebff1d193baa55eaa87e7c13ed71aa4b9
SHA512 24185f394da1e3a462f082f0a6e896fdd1acb4718b382e69dd0f85808f0d7b671fe18f28f85753448e99ee14d9315652314a44a456750b2f8698e4134e3f603e
SSDEEP 1536:1d9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:9dseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 e9702cb09e36faa58cefe1d7f1f348d185f2fe2f6e45837afe7f54ced916eed3
MD5 11bd97bcce3c69d3aa107531ccb45e6a
SHA1 3a80b9b7afcce3c7b6e990c1b9843060de1aca6f
SHA512 90b00a7a0221947b1e44c042ea75be5e60c8311720649f8b257085112b31b6e5752337853ba0d0fb25e8087a0014156ed4aefa34dde30ebbe148b694c35e7bd5
SSDEEP 1536:Bd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:xdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1616-33-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1616-35-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1704-11-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1704-12-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1704-15-0x00000000020F0000-0x000000000211A000-memory.dmp

Download

memory/1704-21-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2428-25-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2848-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2848-8-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads