neconyd | 418395da622c4f81f93db174b004a19d105e4d6fd67d5436642f8162a295665a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
omsecor.exe
Size 35KB
Sample240619-ez5vpstema
SHA256 418395da622c4f81f93db174b004a19d105e4d6fd67d5436642f8162a295665a
MD5 dc480dacb0156401ef14335790bcd466
SHA1 e0a08c40d23ba08b90c62d831b40782d0752a49b
SHA512 439dbe19e2a54133494f0508a537be23bbeb46d4d705be53ef537847350041aeec2fdd0c7b61c26e515d27060dfb080a14c9aea4c310c25ade239ee3a1c31607
SSDEEP 768:96vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:w8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1220	omsecor.exe
4876	omsecor.exe
1632	omsecor.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1640-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x0005000000022f58-3.dat	upx
behavioral2/memory/1220-5-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1640-4-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1220-7-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1220-10-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1220-13-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1220-14-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1220-19-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4876-20-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x00060000000229ae-18.dat	upx
behavioral2/memory/4876-26-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x0005000000022f58-25.dat	upx
behavioral2/memory/1632-27-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1632-29-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1632-32-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1220	1640	omsecor.exe	84
PID 1640 wrote to memory of 1220	1640	omsecor.exe	84
PID 1640 wrote to memory of 1220	1640	omsecor.exe	84
PID 1220 wrote to memory of 4876	1220	omsecor.exe	98
PID 1220 wrote to memory of 4876	1220	omsecor.exe	98
PID 1220 wrote to memory of 4876	1220	omsecor.exe	98
PID 4876 wrote to memory of 1632	4876	omsecor.exe	99
PID 4876 wrote to memory of 1632	4876	omsecor.exe	99
PID 4876 wrote to memory of 1632	4876	omsecor.exe	99

C:\Users\Admin\AppData\Local\Temp\omsecor.exe
"C:\Users\Admin\AppData\Local\Temp\omsecor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 84f822c96e0fa8f153bd01816384277d3cdbc33e726c9852ce77472889b6da11
MD5 7810e695d5e09475495724445e478792
SHA1 02e15f671528d000f95eca1135230ad8092e9dee
SHA512 d7bbca609a62bc0dcc6fb56a3fd9c4a85998b59a9ea429e30e621b6c8de730549d47cdbddb1f75b48e1bed79d1a91888ea2612b01ba3667a0985529469f5a88a
SSDEEP 768:O6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:V8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 0eecbe9eafb6dbee1ab6b7329720286ab4ce23feb4ca35f81b5c236f08402a7e
MD5 dc13457d804f890e5c82e4d38d631eb4
SHA1 8a34b705c4046b0abf1eff3ad66612ab486b72eb
SHA512 9c829b8e1e8b35261fa417687e398a0f00131bb1f04ea88c6e25363dae68fca58a5bcf7ebc0499df89f119188e95dceaaf28a48fab965fea81cb30b75f69c0dd
SSDEEP 768:F6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:I8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 35KB
SHA256 3c43ec56decb44898664a8c2ef2574ebe5167d7295dc3180a36d6f00ecab5344
MD5 a6a102951bb55899bf02b16018894830
SHA1 f2e3d36e17d27759dfb919e6eb9e66fde0aab3c6
SHA512 2dae477d46e1e46f44e8823ec35b5e0ab52c7ed6e07167cecadef06def9348e686465ec71da4197c5422eabaa5668dd23ca0b482e5007ec6571d813e6d6b9f0f
SSDEEP 768:m6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:98Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1220-7-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1220-10-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1220-13-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1220-14-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1220-19-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1220-5-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1632-27-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1632-29-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1632-32-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1640-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1640-4-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4876-20-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4876-26-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads