neconyd | a7c4f6008b758ac75af05bccfe287b7a08de5dec396bc98b692c9e319462de41

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7c4f6008b758ac75af05bccfe287b7a08de5dec396bc98b692c9e319462de41.exe
Size 96KB
Sample240617-a39wlswdpf
SHA256 a7c4f6008b758ac75af05bccfe287b7a08de5dec396bc98b692c9e319462de41
MD5 d1c27ecccb65f2617feb3ed6cce46f5c
SHA1 f372207c4b3cf8b97a6b754d7c272bda9f2ce640
SHA512 8300e9041268b565d91a903bd59d675b3b1fa4aeb31f736a0aa0cd5d2dd5a2cda7b8d14fb8ceef39d66f4eaa5b83357ea554a2f52423e6dde2f243a3eca59888
SSDEEP 1536:VnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:VGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Detects executables built or packed with MPress PE compressor 8 IoCs

resource	yara_rule
behavioral2/memory/4796-0-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4540-11-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x00070000000232b3-9.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4796-17-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000f0000000233a0-32.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3744-33-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x00070000000232b3-42.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2524-44-0x0000000000400000-0x0000000000423000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 6 IoCs

pid	Process
4540	omsecor.exe
2728	omsecor.exe
3744	omsecor.exe
3460	omsecor.exe
2524	omsecor.exe
2816	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4796 set thread context of 2612	4796	a7c4f6008b758ac75af05bccfe287b7a08de5dec396bc98b692c9e319462de41.exe	84
PID 4540 set thread context of 2728	4540	omsecor.exe	88
PID 3744 set thread context of 3460	3744	omsecor.exe	98
PID 2524 set thread context of 2816	2524	omsecor.exe	102

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2132	4540	WerFault.exe	86
2896	4796	WerFault.exe	83
2808	3744	WerFault.exe	97
980	2524	WerFault.exe	100

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 2612	4796	a7c4f6008b758ac75af05bccfe287b7a08de5dec396bc98b692c9e319462de41.exe	84
PID 4796 wrote to memory of 2612	4796	a7c4f6008b758ac75af05bccfe287b7a08de5dec396bc98b692c9e319462de41.exe	84
PID 4796 wrote to memory of 2612	4796	a7c4f6008b758ac75af05bccfe287b7a08de5dec396bc98b692c9e319462de41.exe	84
PID 4796 wrote to memory of 2612	4796	a7c4f6008b758ac75af05bccfe287b7a08de5dec396bc98b692c9e319462de41.exe	84
PID 4796 wrote to memory of 2612	4796	a7c4f6008b758ac75af05bccfe287b7a08de5dec396bc98b692c9e319462de41.exe	84
PID 2612 wrote to memory of 4540	2612	a7c4f6008b758ac75af05bccfe287b7a08de5dec396bc98b692c9e319462de41.exe	86
PID 2612 wrote to memory of 4540	2612	a7c4f6008b758ac75af05bccfe287b7a08de5dec396bc98b692c9e319462de41.exe	86
PID 2612 wrote to memory of 4540	2612	a7c4f6008b758ac75af05bccfe287b7a08de5dec396bc98b692c9e319462de41.exe	86
PID 4540 wrote to memory of 2728	4540	omsecor.exe	88
PID 4540 wrote to memory of 2728	4540	omsecor.exe	88
PID 4540 wrote to memory of 2728	4540	omsecor.exe	88
PID 4540 wrote to memory of 2728	4540	omsecor.exe	88
PID 4540 wrote to memory of 2728	4540	omsecor.exe	88
PID 2728 wrote to memory of 3744	2728	omsecor.exe	97
PID 2728 wrote to memory of 3744	2728	omsecor.exe	97
PID 2728 wrote to memory of 3744	2728	omsecor.exe	97
PID 3744 wrote to memory of 3460	3744	omsecor.exe	98
PID 3744 wrote to memory of 3460	3744	omsecor.exe	98
PID 3744 wrote to memory of 3460	3744	omsecor.exe	98
PID 3744 wrote to memory of 3460	3744	omsecor.exe	98
PID 3744 wrote to memory of 3460	3744	omsecor.exe	98
PID 3460 wrote to memory of 2524	3460	omsecor.exe	100
PID 3460 wrote to memory of 2524	3460	omsecor.exe	100
PID 3460 wrote to memory of 2524	3460	omsecor.exe	100
PID 2524 wrote to memory of 2816	2524	omsecor.exe	102
PID 2524 wrote to memory of 2816	2524	omsecor.exe	102
PID 2524 wrote to memory of 2816	2524	omsecor.exe	102
PID 2524 wrote to memory of 2816	2524	omsecor.exe	102
PID 2524 wrote to memory of 2816	2524	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\a7c4f6008b758ac75af05bccfe287b7a08de5dec396bc98b692c9e319462de41.exe
"C:\Users\Admin\AppData\Local\Temp\a7c4f6008b758ac75af05bccfe287b7a08de5dec396bc98b692c9e319462de41.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\a7c4f6008b758ac75af05bccfe287b7a08de5dec396bc98b692c9e319462de41.exe
  C:\Users\Admin\AppData\Local\Temp\a7c4f6008b758ac75af05bccfe287b7a08de5dec396bc98b692c9e319462de41.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3744
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3460
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:2816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 256
        8⤵
        Program crash
        
        PID:980
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 292
        6⤵
        Program crash
        
        PID:2808
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 300
      4⤵
      Program crash
      PID:2132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 288
  2⤵
  - Program crash
  PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4796 -ip 4796
1⤵
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4540 -ip 4540
1⤵
PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3744 -ip 3744
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2524 -ip 2524
1⤵
PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 7b088606b05db138a722260261bc726dd3c5282184803e7b4049cf815b65e432
MD5 c4ff2cf630a00abba5f2dc28116ddb41
SHA1 bfbe763c34733011f6750debe5ce3e3443e00aad
SHA512 b9bf3d42ddb78b8d26491566cc1a66ce1a6f59983c18104c9be8412fb11ad535a420eb790882c222e3e3b40b4c868f99ad02140139e757ff3080f76621ccb125
SSDEEP 1536:9nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:9Gs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 0d46f535b140158e63167b1f8cf856526c86981583139b4e255c4a2942b51997
MD5 d80f9c294c4ec2c1edf61fbbcf0e19dc
SHA1 681d672921cbe9ff265a95fe60d31df84b975d92
SHA512 0abb3e6d6a6bf455f7cbed9e42bbe7b85c06337cc03f838e7428e8213354e34aa04f224a7fa804034af64434b203767ca66c3b427d5f65924df15d6b0c0d3abc
SSDEEP 1536:xnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:xGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 ab33a0063224061143109d882620da776f3f9e4edcd824723b9087ab50def93d
MD5 a87c526306ea64040d2f0b3e69066cd2
SHA1 16a5f0580d5f504799b1a859807146f1c5704de9
SHA512 15402ac054383fa76b609c8c3c5f00b613d69fe65466270a4fcdfb7526b52cfb9bee6586444cadb2fff484a630d1e037cba8a09bdf9ae47348cefcd911e0fba1
SSDEEP 1536:ZnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:ZGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2524-44-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2612-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2612-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2612-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2612-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2728-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2728-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2728-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2728-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2728-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2728-29-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2728-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2816-55-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2816-52-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2816-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2816-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3460-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3460-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3460-39-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3744-33-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4540-11-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4796-17-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4796-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads