neconyd | 387d7283f3045b144597417657d66d88f68faaee8910d19e2ecdfe9d60dc70e0

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 20:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
387d7283f3045b144597417657d66d88f68faaee8910d19e2ecdfe9d60dc70e0.exe
Size 35KB
Sample240628-y86cdathln
SHA256 387d7283f3045b144597417657d66d88f68faaee8910d19e2ecdfe9d60dc70e0
MD5 b8b7b700f015565a4db5d43aa3501104
SHA1 632970f3218125112af991a78cb7d5f6abb57a7e
SHA512 528601d1de8cfac16ed31e914cc7ad26f15c93893c1a94e4b1d97a1af11396a5126de6532932b8c5eaf0c229dfe8b497c39bee41670bcedff425d8f0caa2738b
SSDEEP 768:X6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:q8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1636	omsecor.exe
336	omsecor.exe
3236	omsecor.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1964-1-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x0009000000023546-3.dat	upx
behavioral2/memory/1964-6-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1636-7-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1636-8-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1636-11-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1636-14-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1636-15-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1636-20-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x0002000000021d02-21.dat	upx
behavioral2/memory/336-23-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x0009000000023546-26.dat	upx
behavioral2/memory/3236-27-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/3236-29-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/3236-32-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1636	1964	387d7283f3045b144597417657d66d88f68faaee8910d19e2ecdfe9d60dc70e0.exe	88
PID 1964 wrote to memory of 1636	1964	387d7283f3045b144597417657d66d88f68faaee8910d19e2ecdfe9d60dc70e0.exe	88
PID 1964 wrote to memory of 1636	1964	387d7283f3045b144597417657d66d88f68faaee8910d19e2ecdfe9d60dc70e0.exe	88
PID 1636 wrote to memory of 336	1636	omsecor.exe	99
PID 1636 wrote to memory of 336	1636	omsecor.exe	99
PID 1636 wrote to memory of 336	1636	omsecor.exe	99
PID 336 wrote to memory of 3236	336	omsecor.exe	100
PID 336 wrote to memory of 3236	336	omsecor.exe	100
PID 336 wrote to memory of 3236	336	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\387d7283f3045b144597417657d66d88f68faaee8910d19e2ecdfe9d60dc70e0.exe
"C:\Users\Admin\AppData\Local\Temp\387d7283f3045b144597417657d66d88f68faaee8910d19e2ecdfe9d60dc70e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:336
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:3236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3812,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
1⤵
PID:4624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 001f5f73492368121849924140b4a16332b598f33e328aa79d9207862c9d49e9
MD5 fb9dcd396cfea6ddbe71122558f54416
SHA1 169b6ce45393230c6f22f4d01e7460f7bc067ec0
SHA512 79f721b968cfebb0e0f5e79e0b078519b20216d1aea8c208ff29eb2eebcd2c439d16f4eb6c4bc7266c1c7e41de50c6fd092ff541888c7c96f9f8ead6183a15ec
SSDEEP 768:R6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:c8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 598087f88ec93ccc7aec57ff429d5e2c3927b34ec0a538a54610a458b32228f3
MD5 0c5e54dec51bd4bbea4fa35175423752
SHA1 8969eb1c6cfc7f128fe6b7cbadced71af42b17aa
SHA512 1e686be6aa1759cb09afb689033dbcac2af3cb1c4a2842720ce8aafff81861aa711053c99ea4fa92e85f59a34b0298302ef016f30022913393b26d7b46d09e4f
SSDEEP 768:b6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:G8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 35KB
SHA256 75a7e61f41f4dc8f6622f9801497c1332b5534d9f8abe4d7d894e3fd58cbdf31
MD5 768230934b6bc86c687f52059564cffa
SHA1 0caba67103d040a006a8e274336101a459b626f5
SHA512 fbaa8553a247b8579662be70b6acb35312e4ee1d8f9c64e4485f8bf02ad8cd7d4b6c575ab5cfd9ff219e6412168c4197cce5ad16bc3a92ae1f4648f2b3a5c20b
SSDEEP 768:x6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:88Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/336-23-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1636-7-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1636-11-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1636-14-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1636-15-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1636-20-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1636-8-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1964-1-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1964-6-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3236-27-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3236-29-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3236-32-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads