neconyd | dee907ad6ad038b2be89acb3dfb5e7a5a404731d8f9b7e6e735e193391960c17

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dee907ad6ad038b2be89acb3dfb5e7a5a404731d8f9b7e6e735e193391960c17.exe
Size 35KB
Sample240702-evtlwavfpg
SHA256 dee907ad6ad038b2be89acb3dfb5e7a5a404731d8f9b7e6e735e193391960c17
MD5 5ea283ddecbe66c2d3ca62a65e6141bd
SHA1 6f962a154036dd27b863c235c8d8e8a8b4d8776d
SHA512 61e2e4a80ecb00d1af0024e279cab3de58dc6a720bae998f4dc954057276d23bc082a26e738cb921a51794477b729154fcb76efbb2ac2b88bcb7aad22c58cc29
SSDEEP 768:36vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:K8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2532	omsecor.exe
1696	omsecor.exe
4684	omsecor.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3560-1-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x000600000002329e-3.dat	upx
behavioral2/memory/2532-6-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2532-7-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2532-10-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2532-13-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2532-14-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2532-19-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x000f000000021581-20.dat	upx
behavioral2/memory/1696-21-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x000600000002329e-24.dat	upx
behavioral2/memory/1696-26-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4684-27-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4684-29-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4684-32-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 2532	3560	dee907ad6ad038b2be89acb3dfb5e7a5a404731d8f9b7e6e735e193391960c17.exe	81
PID 3560 wrote to memory of 2532	3560	dee907ad6ad038b2be89acb3dfb5e7a5a404731d8f9b7e6e735e193391960c17.exe	81
PID 3560 wrote to memory of 2532	3560	dee907ad6ad038b2be89acb3dfb5e7a5a404731d8f9b7e6e735e193391960c17.exe	81
PID 2532 wrote to memory of 1696	2532	omsecor.exe	91
PID 2532 wrote to memory of 1696	2532	omsecor.exe	91
PID 2532 wrote to memory of 1696	2532	omsecor.exe	91
PID 1696 wrote to memory of 4684	1696	omsecor.exe	92
PID 1696 wrote to memory of 4684	1696	omsecor.exe	92
PID 1696 wrote to memory of 4684	1696	omsecor.exe	92

C:\Users\Admin\AppData\Local\Temp\dee907ad6ad038b2be89acb3dfb5e7a5a404731d8f9b7e6e735e193391960c17.exe
"C:\Users\Admin\AppData\Local\Temp\dee907ad6ad038b2be89acb3dfb5e7a5a404731d8f9b7e6e735e193391960c17.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 309ab30dac469cf04cc054c1d8b6835546ba8aea39eff60e498aa5b07f82cf60
MD5 fcbf60f11599df34693406b1bacca27b
SHA1 b6d0caf5593e4eff2f7c2c6cae76d9c925ff64e8
SHA512 a4485640a59dacefaddb674904bbaf6bc8c632eacc594a35dd4d4a69db82ac87e27f36babee519f7fd2fcd73abf3890d64649a81a33f0f52dbfc672c6d9520ca
SSDEEP 768:a6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:Z8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 a56355eaacb70600437f0cbe089d757a9fabaed67a110d758827320e0d73f48a
MD5 ccecca99b2563029d57f0f0f9e4d609e
SHA1 c1218c184c4ab1063a493d1d6c37f364a4f715d9
SHA512 9d5bee1c7c77538ff742a48efca2ca137f36cc54c97eae6408526cf7b1c15699966233db8b39b4160405cfc3fee417e5b46f733c0e088f3aa81988cc712214e4
SSDEEP 768:j6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:e8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 35KB
SHA256 f8a4e4fba34c107168f66251298d069203694990d759de3172701cf8acea4339
MD5 c7f011736a2a10469bd113c3c1ee3d4a
SHA1 0c3a0638eef26e01c2f8df7682305d31bcfe32a4
SHA512 8f9fa50f184dcd4c05cd412e58a4a99f38741db32650ca1e4e76c372d771ab56f20cd387d9428512690c4d32fd6cf37824efcc88512d66dcaa11901323dd3dab
SSDEEP 768:i6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:R8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1696-26-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1696-21-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2532-7-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2532-14-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2532-19-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2532-13-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2532-10-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2532-6-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3560-1-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4684-27-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4684-29-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4684-32-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads