neconyd | 274f79c0d4696619ec8abd5acd11b55b3b2578db9545c44f3d0be2b13b523e2a

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
13f7a091693f7b6cc83e545eedb83c4b_JaffaCakes118.exe
Size 63KB
Sample240627-ab7bea1fpd
SHA256 274f79c0d4696619ec8abd5acd11b55b3b2578db9545c44f3d0be2b13b523e2a
MD5 13f7a091693f7b6cc83e545eedb83c4b
SHA1 6342967f8832dce07bf84af406ba68789d9bfd53
SHA512 16a2124a3d3ed52efabc4959b74242896c78d38ca518aec4f9fe1c8c2eba74a0f4c9ee6e127822d9970c382f42ebb4d81c5a779370d9b41d61c1fc74a3d1d3e2
SSDEEP 768:GfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:GfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1988	omsecor.exe
108	omsecor.exe
1604	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1640	13f7a091693f7b6cc83e545eedb83c4b_JaffaCakes118.exe
1640	13f7a091693f7b6cc83e545eedb83c4b_JaffaCakes118.exe
1988	omsecor.exe
1988	omsecor.exe
108	omsecor.exe
108	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1988	1640	13f7a091693f7b6cc83e545eedb83c4b_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1988	1640	13f7a091693f7b6cc83e545eedb83c4b_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1988	1640	13f7a091693f7b6cc83e545eedb83c4b_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1988	1640	13f7a091693f7b6cc83e545eedb83c4b_JaffaCakes118.exe	28
PID 1988 wrote to memory of 108	1988	omsecor.exe	32
PID 1988 wrote to memory of 108	1988	omsecor.exe	32
PID 1988 wrote to memory of 108	1988	omsecor.exe	32
PID 1988 wrote to memory of 108	1988	omsecor.exe	32
PID 108 wrote to memory of 1604	108	omsecor.exe	33
PID 108 wrote to memory of 1604	108	omsecor.exe	33
PID 108 wrote to memory of 1604	108	omsecor.exe	33
PID 108 wrote to memory of 1604	108	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\13f7a091693f7b6cc83e545eedb83c4b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\13f7a091693f7b6cc83e545eedb83c4b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:108
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 63KB
SHA256 8ae81c46715dc9ffc51c73c2d9f5f0d454ff0f56b605852fd4def53968eca2aa
MD5 25ed2706b8086097ae8a00b397d87347
SHA1 729177fb7148cbc3e16d6e7bb510324c4d7a214f
SHA512 954fcc31dafd4cf1a2edb8d199846e10ad5dc978c921786a79a1e7cc86b1d3d382380937304c32743f7aa2b51a2f21dbd9d99e9e120d256bccef4e57a12d5841
SSDEEP 768:FfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:FfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 63KB
SHA256 7b66195b3867be897d71df1ff34cbe6d8dc4cac62e21fb6f1736ec6a1a233cc8
MD5 57b96a227ec4cbaf961df0cc826d42c0
SHA1 960bb5ce10307ff1c2a52846bbf92bd0c7a7d644
SHA512 31660f07466b0a256396e17053caf94154f66a1339677407b20259bfa5476aa786c7a98c897336e85f1bb25027dbe340f318a3f64136d15ca83b8b86cae15f39
SSDEEP 768:efMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:efbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 63KB
SHA256 6abb834d736e3ae90ccf107a34bbf28da2de7c95386471deeff4ed483c8d71e5
MD5 7b507a70fe2bb5c1c67a7925d24125ec
SHA1 41012c2d32c0a3323e812516a2e679bf3796ad3f
SHA512 f840756bc4bc794d47c79feb20ad7c596245aea5a87ccd727ad0308c0269a62ae8eaa115eaa9dfec8b79db7069e431908a033a8a44d79c5a48c6e86ccf4074e4
SSDEEP 768:BfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:BfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads