neconyd | 224636725e689db81571b84da0cd63573091ff2b86b7d363cdd0e18edf171611

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
224636725e689db81571b84da0cd63573091ff2b86b7d363cdd0e18edf171611.exe
Size 35KB
Sample240702-ycceeswbkf
SHA256 224636725e689db81571b84da0cd63573091ff2b86b7d363cdd0e18edf171611
MD5 c694d03ad1017754a0cf143b541adf1d
SHA1 8626e7a91faabbbb0887f6d69d0a4c5b81e1928c
SHA512 2b0784f96bcb3accbe44957b15e6f118bc8eaada01907553c6d41e7e569a3ea9beec519be04da62238ed4fd86a867febf1ae0c7e107827482dfa2b7e27454a57
SSDEEP 768:f6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:i8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4392	omsecor.exe
3952	omsecor.exe
1136	omsecor.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3380-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x00080000000232a4-3.dat	upx
behavioral2/memory/3380-7-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4392-5-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4392-8-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4392-11-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4392-14-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4392-15-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x000f000000021581-18.dat	upx
behavioral2/memory/4392-20-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/3952-23-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x00080000000232a4-25.dat	upx
behavioral2/memory/1136-27-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1136-29-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/1136-32-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 4392	3380	224636725e689db81571b84da0cd63573091ff2b86b7d363cdd0e18edf171611.exe	81
PID 3380 wrote to memory of 4392	3380	224636725e689db81571b84da0cd63573091ff2b86b7d363cdd0e18edf171611.exe	81
PID 3380 wrote to memory of 4392	3380	224636725e689db81571b84da0cd63573091ff2b86b7d363cdd0e18edf171611.exe	81
PID 4392 wrote to memory of 3952	4392	omsecor.exe	91
PID 4392 wrote to memory of 3952	4392	omsecor.exe	91
PID 4392 wrote to memory of 3952	4392	omsecor.exe	91
PID 3952 wrote to memory of 1136	3952	omsecor.exe	92
PID 3952 wrote to memory of 1136	3952	omsecor.exe	92
PID 3952 wrote to memory of 1136	3952	omsecor.exe	92

C:\Users\Admin\AppData\Local\Temp\224636725e689db81571b84da0cd63573091ff2b86b7d363cdd0e18edf171611.exe
"C:\Users\Admin\AppData\Local\Temp\224636725e689db81571b84da0cd63573091ff2b86b7d363cdd0e18edf171611.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:1136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 174c9321d0dc37fc426b4ef0d4a368e9131e4d458023fa8524e03d554ae78cb5
MD5 11a349117a7d68bd7bd523449c2eb791
SHA1 75b01298932493ed3a58d00495696be9d09d4b4c
SHA512 256f988f6dabf2fb218cef5ae533ee057143be5d08d33c5ce0de674e790b1757bdc85f12340b9b4eb5fe79bd8f98ccf71c3552af5a3141c943b168460b89e66e
SSDEEP 768:46vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:/8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 ca0ec237cfee765b6789004977cdb2b543ffe95b39d74f2884286c3b735a1a1d
MD5 a4bc58e15e1d74953f80aec0ed39941e
SHA1 a93b894407b91498642a11ef89f4bf2313538610
SHA512 b84c7d67a5bc5d6b28705ce57b94c61d034b1cd265863e1a33e1989ec8d5f61c5aba36cb9c09250014e9ece6b494a7db9a39a50f6ecd6f9169d6dfa9dbe475fa
SSDEEP 768:g6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:38Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 35KB
SHA256 055a3d81a41ec2b4bcbc7b66a023c2f9e67dcd6c894b87314f15a3a4bd055bc5
MD5 133454b1f99dcbcbf9198f702090b5bc
SHA1 ce72e617da9178543c15d71ac158d7f40aa35d61
SHA512 26b4195bbf0712e8c5335b37790857a0c6891d4e0795af707e42d8b5cbf6feb2c63278f228c48a68cf90efc0b7286ed0c632a0db1f041503332c3098ea7bc5c4
SSDEEP 768:E6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:T8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1136-32-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1136-29-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1136-27-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3380-7-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3380-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3952-23-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4392-14-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4392-20-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4392-15-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4392-11-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4392-8-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4392-5-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads