neconyd | c0ce515c1ec49d7f7a840404e15f45c5ea39281a6b9acdd37f710c756a500125

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 03:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c0ce515c1ec49d7f7a840404e15f45c5ea39281a6b9acdd37f710c756a500125.exe
Size 72KB
Sample240614-d6l6hatenh
SHA256 c0ce515c1ec49d7f7a840404e15f45c5ea39281a6b9acdd37f710c756a500125
MD5 9857aa37e4080016c42489ae40f3fae9
SHA1 698842953c11a78c23b726852b318ee521e67f1b
SHA512 441a584ca5b090560771aecdebcd688e58d928bc0f4332ca7770038624012443d60549d89a68d373c9b976f77acbff31701c1a9f1330684d9f79cc982151efb3
SSDEEP 768:YMEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:YbIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
936	omsecor.exe
2940	omsecor.exe
1152	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 936	1664	c0ce515c1ec49d7f7a840404e15f45c5ea39281a6b9acdd37f710c756a500125.exe	84
PID 1664 wrote to memory of 936	1664	c0ce515c1ec49d7f7a840404e15f45c5ea39281a6b9acdd37f710c756a500125.exe	84
PID 1664 wrote to memory of 936	1664	c0ce515c1ec49d7f7a840404e15f45c5ea39281a6b9acdd37f710c756a500125.exe	84
PID 936 wrote to memory of 2940	936	omsecor.exe	95
PID 936 wrote to memory of 2940	936	omsecor.exe	95
PID 936 wrote to memory of 2940	936	omsecor.exe	95
PID 2940 wrote to memory of 1152	2940	omsecor.exe	96
PID 2940 wrote to memory of 1152	2940	omsecor.exe	96
PID 2940 wrote to memory of 1152	2940	omsecor.exe	96

C:\Users\Admin\AppData\Local\Temp\c0ce515c1ec49d7f7a840404e15f45c5ea39281a6b9acdd37f710c756a500125.exe
"C:\Users\Admin\AppData\Local\Temp\c0ce515c1ec49d7f7a840404e15f45c5ea39281a6b9acdd37f710c756a500125.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 0d4623bd24a5b9ae802973fbc202b53e567dbef8f55ddf0a05223d6fdb0ab3b1
MD5 f6fd4c98a31f2f4e346826a9a8512167
SHA1 41dce1ae0bc2f9a7b3188ea33384498ca02c50c6
SHA512 a938ca8408ff2859039792d4d4e2ee7ad26b6dda4e3383edec4bba345eb4b6b6576dede29f8915cbaae69a3d66ce477de8e097b4df6003ba5da5ff8ab87e0972
SSDEEP 768:EMEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:EbIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 72KB
SHA256 1ef5cc59bfed4825bb9fc7012f0497acb4dc8a97cf53fb2fb0be3e5fb82ba757
MD5 5ef3735b67edc4baf4004a128cea46e7
SHA1 63e6adc6613f9131844f43fc4620dd89ec09f55a
SHA512 3ccfffb03893922e93a1cbde946150779c15a9456da52502c655d2e78901173d202866309788b1a999ca107a6c0185f745b4a704d17a261fb33fec68069c304d
SSDEEP 768:BMEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:BbIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 72KB
SHA256 f2bf78263a83d658fecfcc821dfeec23816a6b0da74c887c30aebc6616681a41
MD5 6b598e5300e73dd180d0f637e4eae26f
SHA1 5cbb787ea451f2384605e76f3dd9b765184b671d
SHA512 ae450161c0776288460f731623643f0bdc5912650ed09a58b4537b6530123dd618f7b405c199f8728a1c7e773004eb12aac96392ce40842f8b82712cc33b01f8
SSDEEP 768:tMEIvFGvoEr8LFK0ic46N47eSvYAHwmZGp6JXXlaa5uA:tbIvYvoEyFKF6N4ySAAQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/936-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/936-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/936-11-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1152-17-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1152-20-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1664-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1664-4-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2940-12-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2940-19-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads