neconyd | d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/07/2024, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1.exe
Size 92KB
Sample240702-d66j5stfja
SHA256 d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1
MD5 4c8fbc3f0ca13775ebb666767898050d
SHA1 45c1e441d3c067ed3587a16351f3a8fa4f2543d1
SHA512 819aa660cc3f4f3e6198b4a7eb726ef3f2ef61342c30039dcd3d2b0fcb40ca918a2233f0c9c406610aef0573cf0a1afb5731d9fa2885be2ee6318c46189e2537
SSDEEP 768:UMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:UbIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1696	omsecor.exe
1764	omsecor.exe
2212	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
376	d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1.exe
376	d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1.exe
1696	omsecor.exe
1696	omsecor.exe
1764	omsecor.exe
1764	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 1696	376	d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1.exe	28
PID 376 wrote to memory of 1696	376	d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1.exe	28
PID 376 wrote to memory of 1696	376	d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1.exe	28
PID 376 wrote to memory of 1696	376	d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1.exe	28
PID 1696 wrote to memory of 1764	1696	omsecor.exe	32
PID 1696 wrote to memory of 1764	1696	omsecor.exe	32
PID 1696 wrote to memory of 1764	1696	omsecor.exe	32
PID 1696 wrote to memory of 1764	1696	omsecor.exe	32
PID 1764 wrote to memory of 2212	1764	omsecor.exe	33
PID 1764 wrote to memory of 2212	1764	omsecor.exe	33
PID 1764 wrote to memory of 2212	1764	omsecor.exe	33
PID 1764 wrote to memory of 2212	1764	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1.exe
"C:\Users\Admin\AppData\Local\Temp\d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:376
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 584dea0e835f4c2eabe626935caa3f08387e3161736d7a64d6e1a9718d4258ad
MD5 a8af523ab59c7f15dfccd9f0400e5444
SHA1 9c6895e6a294b361205070ca28fc6177b05f3149
SHA512 8c85dfbc9c0c4a94329950c00e1bc29a5e74c3fd8ef13e9648829e89f93f716eea381949ba7d1afab3b4e4d5bf9aa860428df5c10858f129fc236cba164994b2
SSDEEP 768:sMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:sbIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 44fa77263ba2f49b20b15c32efed983678cec9f6f64c1526b051f907593b8c4a
MD5 467bfc6bad45375fb2b531ff534e4a48
SHA1 d0ffebe47afa635fc4c900c5b4c42822730b1adc
SHA512 62b78e614ae1d78b60584e7d89cb84b77054ca11db1191f5a3d9448ae66ce7dceab3aa7a5068a1602084aa127a80958ab528af4dc0b7ad78ca51d6da899f1f90
SSDEEP 768:eMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:ebIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 92KB
SHA256 892a9ab6fc57e2459d0392c2ed2686a67431e7b7878cdfa457a03cfdf63bdc25
MD5 ff01fac0be0adcb8d639ee1f03ebb929
SHA1 a6d76120c8dc0b35eb4745bf5da1b23178b866f5
SHA512 a4b1f8880e902c31a25ea651b56057a2f9e6b59aa309f3bed3adfa39abf9019aa92f1bdf8df12e6b48a9c47577dde3524042994da35df27bff158a7c1ef96250
SSDEEP 768:yMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:ybIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/376-8-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/376-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1696-15-0x0000000002050000-0x000000000207B000-memory.dmp

Download

memory/1696-12-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1696-21-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1696-10-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1764-34-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1764-32-0x0000000000230000-0x000000000025B000-memory.dmp

Download

memory/1764-31-0x0000000000230000-0x000000000025B000-memory.dmp

Download

memory/2212-36-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads