neconyd | 8bc55600e204e023eb09abc63317dc6fb3a13abaecc30840039083c4e427ef9a

General

Target

8bc55600e204e023eb09abc63317dc6fb3a13abaecc30840039083c4e427ef9a.exe
Size

35KB
MD5

692c37c16abf8cef8cd25830e274c63f
SHA1

641ebc7e8eba0d9b479f2f1a7c3e69f414161f1b
SHA256

8bc55600e204e023eb09abc63317dc6fb3a13abaecc30840039083c4e427ef9a
SHA512

ed5714b6a5f005f11ae2868202d50b77e3b7714c15dff23ce865b463741cc020fda1fe9c464bd5bf214edb769f434950fc0eba2f13aaa0c84d3d7af70b626965
SSDEEP

768:b6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:G8Z0kA7FHlO2OwOTUtKjpB

Score

10^/10

neconyd trojan upx

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

UPX dump on OEP (original entry point) 16 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4248-0-0x0000000000400000-0x000000000042D000-memory.dmp	UPX
C:\Users\Admin\AppData\Roaming\omsecor.exe	UPX
behavioral2/memory/2344-5-0x0000000000400000-0x000000000042D000-memory.dmp	UPX
behavioral2/memory/4248-6-0x0000000000400000-0x000000000042D000-memory.dmp	UPX
behavioral2/memory/2344-7-0x0000000000400000-0x000000000042D000-memory.dmp	UPX
behavioral2/memory/2344-10-0x0000000000400000-0x000000000042D000-memory.dmp	UPX
behavioral2/memory/2344-13-0x0000000000400000-0x000000000042D000-memory.dmp	UPX
behavioral2/memory/2344-14-0x0000000000400000-0x000000000042D000-memory.dmp	UPX
C:\Windows\SysWOW64\omsecor.exe	UPX
behavioral2/memory/4912-18-0x0000000000400000-0x000000000042D000-memory.dmp	UPX
behavioral2/memory/2344-21-0x0000000000400000-0x000000000042D000-memory.dmp	UPX
C:\Users\Admin\AppData\Roaming\omsecor.exe	UPX
behavioral2/memory/4912-26-0x0000000000400000-0x000000000042D000-memory.dmp	UPX
behavioral2/memory/4468-27-0x0000000000400000-0x000000000042D000-memory.dmp	UPX
behavioral2/memory/4468-29-0x0000000000400000-0x000000000042D000-memory.dmp	UPX
behavioral2/memory/4468-32-0x0000000000400000-0x000000000042D000-memory.dmp	UPX

Executes dropped EXE 3 IoCs

Processes:

omsecor.exeomsecor.exeomsecor.exe

pid process

2344 omsecor.exe
4912 omsecor.exe
4468 omsecor.exe

pid	process
2344	omsecor.exe
4912	omsecor.exe
4468	omsecor.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4248-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\omsecor.exe	upx
behavioral2/memory/2344-5-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4248-6-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2344-7-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2344-10-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2344-13-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2344-14-0x0000000000400000-0x000000000042D000-memory.dmp	upx
C:\Windows\SysWOW64\omsecor.exe	upx
behavioral2/memory/4912-18-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2344-21-0x0000000000400000-0x000000000042D000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\omsecor.exe	upx
behavioral2/memory/4912-26-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4468-27-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4468-29-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4468-32-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

Processes:

omsecor.exe

description ioc process

File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe

description	ioc	process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

8bc55600e204e023eb09abc63317dc6fb3a13abaecc30840039083c4e427ef9a.exeomsecor.exeomsecor.exe

description	pid	process	target process
PID 4248 wrote to memory of 2344	4248	8bc55600e204e023eb09abc63317dc6fb3a13abaecc30840039083c4e427ef9a.exe	omsecor.exe
PID 4248 wrote to memory of 2344	4248	8bc55600e204e023eb09abc63317dc6fb3a13abaecc30840039083c4e427ef9a.exe	omsecor.exe
PID 4248 wrote to memory of 2344	4248	8bc55600e204e023eb09abc63317dc6fb3a13abaecc30840039083c4e427ef9a.exe	omsecor.exe
PID 2344 wrote to memory of 4912	2344	omsecor.exe	omsecor.exe
PID 2344 wrote to memory of 4912	2344	omsecor.exe	omsecor.exe
PID 2344 wrote to memory of 4912	2344	omsecor.exe	omsecor.exe
PID 4912 wrote to memory of 4468	4912	omsecor.exe	omsecor.exe
PID 4912 wrote to memory of 4468	4912	omsecor.exe	omsecor.exe
PID 4912 wrote to memory of 4468	4912	omsecor.exe	omsecor.exe

C:\Users\Admin\AppData\Local\Temp\8bc55600e204e023eb09abc63317dc6fb3a13abaecc30840039083c4e427ef9a.exe
"C:\Users\Admin\AppData\Local\Temp\8bc55600e204e023eb09abc63317dc6fb3a13abaecc30840039083c4e427ef9a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4248

C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\SysWOW64\omsecor.exe
C:\Windows\System32\omsecor.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912

C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
4⤵
- Executes dropped EXE
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3976 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:1376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe
Filesize
35KB

MD5
8291f8df114aa314e1d2ece346f26618

SHA1
9e0bc936b9a3664a071f60ff0a6d2211de1f92f8

SHA256
ffcf9a4fb7df9fe822fa8133bc34e1bb49ee9aa0c7b49ff1e23ecf9865e116cb

SHA512
08bd3c295eaf8c5b309715f3522b95cc08339721787c2ea0a58c6174a83dc7287a86bdf0133661358776b143c95a1d8bd11f964b767c3cd3be4c61633ff0ac47

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe
Filesize
35KB

MD5
543410c82f8490b634419c0dc3538e3d

SHA1
455ab12d07ac106c8227fbf37c7f94a57a1c2bda

SHA256
a324a7fcae58aa4187e00b731021a1241042fe7222e6b9f21bcff3650c5d28f5

SHA512
be296076cb1a86a98a37f866c90e595b2ae90fc420415e13b33db599c3ef6893e36d44ca24455552b83f56a49701abe7b7273fa990b0a9ca69033ea55d40eb14

Download Submit
C:\Windows\SysWOW64\omsecor.exe
Filesize
35KB

MD5
899428ace4d41d0629b256ae619faf90

SHA1
29c305c0e2140cbf76fc8bf11a3837a1ca908522

SHA256
667c585857eb151232a9c102fc1e3e6e491728ca6026fe0bc6c54f24eb1782a8

SHA512
aa289d867085e75707861d7af373b38a63a23174534d974cec6d6624eac1e16a4f55f0a96de90c1883b7b1fa0db5b1b9ec79f55eaea3d6248580fa83de752b6d

Download Submit
memory/2344-7-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2344-10-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2344-13-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2344-14-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2344-21-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2344-5-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4248-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4248-6-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4468-27-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4468-29-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4468-32-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4912-18-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4912-26-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads