neconyd | d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1.exe
Size 92KB
Sample240702-d66j5stfja
SHA256 d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1
MD5 4c8fbc3f0ca13775ebb666767898050d
SHA1 45c1e441d3c067ed3587a16351f3a8fa4f2543d1
SHA512 819aa660cc3f4f3e6198b4a7eb726ef3f2ef61342c30039dcd3d2b0fcb40ca918a2233f0c9c406610aef0573cf0a1afb5731d9fa2885be2ee6318c46189e2537
SSDEEP 768:UMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:UbIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4836	omsecor.exe
4260	omsecor.exe
4232	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 4836	3876	d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1.exe	82
PID 3876 wrote to memory of 4836	3876	d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1.exe	82
PID 3876 wrote to memory of 4836	3876	d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1.exe	82
PID 4836 wrote to memory of 4260	4836	omsecor.exe	97
PID 4836 wrote to memory of 4260	4836	omsecor.exe	97
PID 4836 wrote to memory of 4260	4836	omsecor.exe	97
PID 4260 wrote to memory of 4232	4260	omsecor.exe	98
PID 4260 wrote to memory of 4232	4260	omsecor.exe	98
PID 4260 wrote to memory of 4232	4260	omsecor.exe	98

C:\Users\Admin\AppData\Local\Temp\d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1.exe
"C:\Users\Admin\AppData\Local\Temp\d1866d88c8ed23eb875d9be8858a8e299cd892e6e01d4eafc649e34967b880f1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 5c49860887cc69dc76c7af936490c1132240689a3c64edcdb79ba50c943ecb03
MD5 1b015b3dcee8207d1cc79f86d12032e5
SHA1 d0e8fc4f06f01e62671d1af770f33849a441b02e
SHA512 3c46b7ba3dc0dfdb643a0ac1d4346ac54e50ee9541e9058fbb3db2a7a5d67b4b1e74a0197a537eef05d595e706789798080bde9a66a495edee3624dac775857c
SSDEEP 768:EMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:EbIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 584dea0e835f4c2eabe626935caa3f08387e3161736d7a64d6e1a9718d4258ad
MD5 a8af523ab59c7f15dfccd9f0400e5444
SHA1 9c6895e6a294b361205070ca28fc6177b05f3149
SHA512 8c85dfbc9c0c4a94329950c00e1bc29a5e74c3fd8ef13e9648829e89f93f716eea381949ba7d1afab3b4e4d5bf9aa860428df5c10858f129fc236cba164994b2
SSDEEP 768:sMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:sbIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 92KB
SHA256 92b8e13c1cbe6e33c4a8e07b9608ceb022edd0d3b5fbabc6cc9775b9af3f3d9b
MD5 2de757648e80540b93b9fd239475548e
SHA1 91b36e9e97b38ba2346b8f472f69edd1a2ee7fc3
SHA512 6879cf7a6021b917a368c16fb8265d5cb8421e48f0c35c71aeacd0a82e80b67d28ef2ce708233034e97def61097c675039846a67158a55709f411cbecc47dda6
SSDEEP 768:UMEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:UbIvYvZEgFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3876-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3876-5-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4232-18-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4232-20-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4260-12-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4260-17-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4836-4-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4836-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4836-11-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads