neconyd | 92cbda6a049b39afac22af3f5f9a025dacabfd55decbcf1bbe6ce75a5b1d7814

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 00:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92cbda6a049b39afac22af3f5f9a025dacabfd55decbcf1bbe6ce75a5b1d7814.exe
Size 84KB
Sample240626-axf2catcmc
SHA256 92cbda6a049b39afac22af3f5f9a025dacabfd55decbcf1bbe6ce75a5b1d7814
MD5 08777113d6e8fb04223289d434c0a62b
SHA1 b5354ebc309c39c8a6b02a87c773c879bdfbee0e
SHA512 bf11190a848f8b7eb6c580452f155bdf0b41f686c3810e63ec2321475397b7111b603fcf8d324d8f38514143d27794d699844370c839cfa5050565a41cc97d02
SSDEEP 1536:Cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:ydseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
5068	omsecor.exe
4180	omsecor.exe
4880	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 5068	3712	92cbda6a049b39afac22af3f5f9a025dacabfd55decbcf1bbe6ce75a5b1d7814.exe	82
PID 3712 wrote to memory of 5068	3712	92cbda6a049b39afac22af3f5f9a025dacabfd55decbcf1bbe6ce75a5b1d7814.exe	82
PID 3712 wrote to memory of 5068	3712	92cbda6a049b39afac22af3f5f9a025dacabfd55decbcf1bbe6ce75a5b1d7814.exe	82
PID 5068 wrote to memory of 4180	5068	omsecor.exe	98
PID 5068 wrote to memory of 4180	5068	omsecor.exe	98
PID 5068 wrote to memory of 4180	5068	omsecor.exe	98
PID 4180 wrote to memory of 4880	4180	omsecor.exe	99
PID 4180 wrote to memory of 4880	4180	omsecor.exe	99
PID 4180 wrote to memory of 4880	4180	omsecor.exe	99

C:\Users\Admin\AppData\Local\Temp\92cbda6a049b39afac22af3f5f9a025dacabfd55decbcf1bbe6ce75a5b1d7814.exe
"C:\Users\Admin\AppData\Local\Temp\92cbda6a049b39afac22af3f5f9a025dacabfd55decbcf1bbe6ce75a5b1d7814.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 e08f3564fd10737f969dc697163ed42145edbf9486c7fc9baf8f74989ec54031
MD5 d7a3d860bcdc454c5d1ed0da707756c4
SHA1 4925aeeb9961416c4bd8251b2841221b27c80f9e
SHA512 765ab8dea831473f8bc2a8d4c00521c6c01b4c4a528d03c451d73bda67cd37d2066f632878c45d59d2f81de3da28ee7343538b08d676e851781396f799b63243
SSDEEP 1536:jd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:DdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 609de2e76c0bdfcbb3d421637b15ecb9c892d38b723bd6217725166483a61034
MD5 3724391fa8f76513894ca0e447e55da6
SHA1 c8190ac47eeeaa53123808739be94a56e99f549f
SHA512 2d1abcb3198aaf03260cb385f448111527531b0d65806f13d302a600a55e4e3560f9f7d9508b4143909de3538452628623756272726a710e8ab9e67b3a91159c
SSDEEP 1536:7d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:LdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 36789fa47d5f6a0edfd53fcfccc4dc7a9d04806b6d3a509527b078d4c306937d
MD5 3c4f15e9fc6458bb299d2d0d828815ba
SHA1 af08e99346f670c2c1e2f9a679656a1e929ebffc
SHA512 5d01c7f4c2fdd661c52d50f7a9292afe8e01ea47c3bdf97a3a17c1da57cab212fa04422c10e0a456247544994a36c5b685b503aed2100690cad468720f54991a
SSDEEP 1536:zd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:zdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads