neconyd | 69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f

Analysis

max time kernel
146s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe
Size

96KB
MD5

a5695f66f5e56ec8ceb2d4104b5c169d
SHA1

213fe3490e05f89cd98d64e1366f35e1b6ecdc82
SHA256

69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f
SHA512

ccc5b57917d6c05c9644ccef2a04fb940b015223e979b10312a8b4fa71f5b7e77896242231e6149f55bfc66ec282d6f34460d06fd51629bbb2d4d23364d3ccd1
SSDEEP

1536:hnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:hGs8cd8eXlYairZYqMddH13L

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Detects executables built or packed with MPress PE compressor 13 IoCs

resource	yara_rule
behavioral1/memory/2136-0-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2136-7-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000b000000015bb9-14.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2332-21-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2332-31-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0005000000004ed7-45.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2584-46-0x00000000002D0000-0x00000000002F3000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1268-56-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1268-64-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000b000000015bb9-69.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2892-70-0x0000000000260000-0x0000000000283000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2992-79-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2992-86-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 6 IoCs

pid	Process
2332	omsecor.exe
2584	omsecor.exe
1268	omsecor.exe
2892	omsecor.exe
2992	omsecor.exe
2940	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2472	69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe
2472	69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe
2332	omsecor.exe
2584	omsecor.exe
2584	omsecor.exe
2892	omsecor.exe
2892	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2136 set thread context of 2472	2136	69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe	28
PID 2332 set thread context of 2584	2332	omsecor.exe	30
PID 1268 set thread context of 2892	1268	omsecor.exe	35
PID 2992 set thread context of 2940	2992	omsecor.exe	37

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2472	2136	69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe	28
PID 2136 wrote to memory of 2472	2136	69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe	28
PID 2136 wrote to memory of 2472	2136	69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe	28
PID 2136 wrote to memory of 2472	2136	69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe	28
PID 2136 wrote to memory of 2472	2136	69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe	28
PID 2136 wrote to memory of 2472	2136	69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe	28
PID 2472 wrote to memory of 2332	2472	69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe	29
PID 2472 wrote to memory of 2332	2472	69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe	29
PID 2472 wrote to memory of 2332	2472	69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe	29
PID 2472 wrote to memory of 2332	2472	69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe	29
PID 2332 wrote to memory of 2584	2332	omsecor.exe	30
PID 2332 wrote to memory of 2584	2332	omsecor.exe	30
PID 2332 wrote to memory of 2584	2332	omsecor.exe	30
PID 2332 wrote to memory of 2584	2332	omsecor.exe	30
PID 2332 wrote to memory of 2584	2332	omsecor.exe	30
PID 2332 wrote to memory of 2584	2332	omsecor.exe	30
PID 2584 wrote to memory of 1268	2584	omsecor.exe	34
PID 2584 wrote to memory of 1268	2584	omsecor.exe	34
PID 2584 wrote to memory of 1268	2584	omsecor.exe	34
PID 2584 wrote to memory of 1268	2584	omsecor.exe	34
PID 1268 wrote to memory of 2892	1268	omsecor.exe	35
PID 1268 wrote to memory of 2892	1268	omsecor.exe	35
PID 1268 wrote to memory of 2892	1268	omsecor.exe	35
PID 1268 wrote to memory of 2892	1268	omsecor.exe	35
PID 1268 wrote to memory of 2892	1268	omsecor.exe	35
PID 1268 wrote to memory of 2892	1268	omsecor.exe	35
PID 2892 wrote to memory of 2992	2892	omsecor.exe	36
PID 2892 wrote to memory of 2992	2892	omsecor.exe	36
PID 2892 wrote to memory of 2992	2892	omsecor.exe	36
PID 2892 wrote to memory of 2992	2892	omsecor.exe	36
PID 2992 wrote to memory of 2940	2992	omsecor.exe	37
PID 2992 wrote to memory of 2940	2992	omsecor.exe	37
PID 2992 wrote to memory of 2940	2992	omsecor.exe	37
PID 2992 wrote to memory of 2940	2992	omsecor.exe	37
PID 2992 wrote to memory of 2940	2992	omsecor.exe	37
PID 2992 wrote to memory of 2940	2992	omsecor.exe	37

C:\Users\Admin\AppData\Local\Temp\69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe
"C:\Users\Admin\AppData\Local\Temp\69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\Temp\69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe
  C:\Users\Admin\AppData\Local\Temp\69c50512add578cf1523cc690877c35e61dafe105472320d5c619d594930371f.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1268
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2892
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2992
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
7ce1fbded925b97dcc2dcd13e8c9213e

SHA1
dc6d70140e985d7d5fc7a45b5f8524eb508ad187

SHA256
0fd930f8e9962e4a335b5d24d2ab770d66c2b213323db57a3236df646ee49e30

SHA512
f33f4eaa4960c22742ef18856a007394942bd3c26e9d84161781885e868f9f403a8f293447bff901a6b09ec38834c907d027f25c5ebeea14c63e9047843f1c50

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
49f3db7a269356f83390f9fecc98564c

SHA1
714065689d694dbfc4014df0a46fed7a740278ee

SHA256
3055f5b962a924abd3517adb737200b93cf4eaf72551cee4092786719cad19dd

SHA512
446b248906a4165a8c84ed1bfee9e5f28be3bc108334f821031e7dfc12ff7bc2e07d2040f0f6a6da36da8605a0b5bf2bf97a98a046cbbf3d5238282183553790

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
c0b3fbac75f9546e88e68e6eb1152ecc

SHA1
92f06972f463b26259efbb6e262095bf95bd11a2

SHA256
5fbb52818371f0a332e78a1f2b2cda60f7ef52b7dda8ef8b923714cf0849fe7b

SHA512
ddf4dace77d4c0e14152af65195f76867177a3dc8e50dca5e3cab37ea4c4908c451bb20fd07134060d759f07997bb803f8ea1c292d6741068b879a2d8f7ad147

Download Submit
memory/1268-64-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1268-56-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2136-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2136-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2332-31-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2332-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2472-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2472-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2472-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2472-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2472-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2584-43-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2584-46-0x00000000002D0000-0x00000000002F3000-memory.dmp

Filesize
140KB

Download
memory/2584-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2584-34-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2584-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2584-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2892-70-0x0000000000260000-0x0000000000283000-memory.dmp

Filesize
140KB

Download
memory/2940-89-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2940-92-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2992-79-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2992-86-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download