neconyd | 533301b54cf0ef69842a4ea9592e5ca39c85d010cc98f9725c64b595b4b99e97

Analysis

max time kernel
142s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
533301b54cf0ef69842a4ea9592e5ca39c85d010cc98f9725c64b595b4b99e97.exe
Size 76KB
Sample240613-2t4f1stflg
SHA256 533301b54cf0ef69842a4ea9592e5ca39c85d010cc98f9725c64b595b4b99e97
MD5 d03bf01a68f12c227981a5685494dbf0
SHA1 d3cd1fa2c4ac48d1d35026c1792cadd29c79b7af
SHA512 ebb8ed3218898c66ce716c7a18c150eaa900b81f535f2626e876b9218fee3d1a23d070d253383c24b08e98fb32501abf00ac2324635143f0e8d88afb2df54f32
SSDEEP 1536:xd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:BdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
3984	omsecor.exe
2220	omsecor.exe
4012	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 3984	1344	533301b54cf0ef69842a4ea9592e5ca39c85d010cc98f9725c64b595b4b99e97.exe	81
PID 1344 wrote to memory of 3984	1344	533301b54cf0ef69842a4ea9592e5ca39c85d010cc98f9725c64b595b4b99e97.exe	81
PID 1344 wrote to memory of 3984	1344	533301b54cf0ef69842a4ea9592e5ca39c85d010cc98f9725c64b595b4b99e97.exe	81
PID 3984 wrote to memory of 2220	3984	omsecor.exe	89
PID 3984 wrote to memory of 2220	3984	omsecor.exe	89
PID 3984 wrote to memory of 2220	3984	omsecor.exe	89
PID 2220 wrote to memory of 4012	2220	omsecor.exe	90
PID 2220 wrote to memory of 4012	2220	omsecor.exe	90
PID 2220 wrote to memory of 4012	2220	omsecor.exe	90

C:\Users\Admin\AppData\Local\Temp\533301b54cf0ef69842a4ea9592e5ca39c85d010cc98f9725c64b595b4b99e97.exe
"C:\Users\Admin\AppData\Local\Temp\533301b54cf0ef69842a4ea9592e5ca39c85d010cc98f9725c64b595b4b99e97.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 f96f84d397cb1bdd509e5fd3677b5a26d8e74df7daf413fce32fa3f98fee06b7
MD5 85566047a225d259b862f2bb86f1601b
SHA1 e00f458aac98330086a47e8c71f6eaecaa88e3ae
SHA512 31e17a4c7a2e93c1a41c2ecac9e90d46708af73d002addd9bea1520daac11a243ed693e08f9b8abd09449af8eca7ea0108a110682633282e188decdadf177fb0
SSDEEP 1536:Xd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:fdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 74a4d03bfd6d7d32d047d9c96d2a15b46b201a575dc1818606895ab5c96cee67
MD5 7f12fea9662ad20304339ce253efec40
SHA1 ce39320091985adf77329b7490df35cb988cfa5e
SHA512 a521d513045e382fb642c4ed6066af8e6dc8f8e3c9b13cb2d71a5eb1347d150a54737457bd4f7942b219ad8bb110e1ae0cd80f5035b958e68a558c8d1ac93342
SSDEEP 1536:Vd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:ddseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 044d64909863c0b093d3d3f6d81348063876dd59a3dae07ff7c54798100c70f1
MD5 244ab902d28cf1fe791ecc2f09f6bf47
SHA1 85518d1cc1e9b7ec3a9efd05aa84ebfa70261a62
SHA512 a134afab9dbdfe1ab38d677922451d9346a8aaecd676dcf188c6277acc4c59fb1abdd7ec64657350a953170634438906e98f8176a2cad289ff6290c976e4cccc
SSDEEP 1536:Hd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:vdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1344-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1344-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2220-13-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2220-16-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3984-6-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3984-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3984-11-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4012-18-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4012-20-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads