neconyd | 18ec543ce0b8ea6352af0fd88e667b7de32620eb974f7472cd63767eefd47a4a

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18ec543ce0b8ea6352af0fd88e667b7de32620eb974f7472cd63767eefd47a4a.exe
Size 96KB
Sample240703-25gfmasflc
SHA256 18ec543ce0b8ea6352af0fd88e667b7de32620eb974f7472cd63767eefd47a4a
MD5 58f4bd27612d983779bdb15c5cbd42a0
SHA1 c6c210fae3ef4c0fd0d9dfd396adc6413ce61a8d
SHA512 8c4fca7c49e54ed43e017fc9afec0c19b2a8d4e90e60da9f94cfcefb45e7abfe56d31087985f5efeb0b1bb5ac18500197decc7b5eda6e5bc934a980f9804c5b8
SSDEEP 1536:LnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:LGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
2900	omsecor.exe
1692	omsecor.exe
3880	omsecor.exe
4308	omsecor.exe
4732	omsecor.exe
1920	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 440 set thread context of 4524	440	18ec543ce0b8ea6352af0fd88e667b7de32620eb974f7472cd63767eefd47a4a.exe	82
PID 2900 set thread context of 1692	2900	omsecor.exe	86
PID 3880 set thread context of 4308	3880	omsecor.exe	98
PID 4732 set thread context of 1920	4732	omsecor.exe	102

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3904	2900	WerFault.exe	84
2096	440	WerFault.exe	81
4276	3880	WerFault.exe	97
2852	4732	WerFault.exe	100

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 4524	440	18ec543ce0b8ea6352af0fd88e667b7de32620eb974f7472cd63767eefd47a4a.exe	82
PID 440 wrote to memory of 4524	440	18ec543ce0b8ea6352af0fd88e667b7de32620eb974f7472cd63767eefd47a4a.exe	82
PID 440 wrote to memory of 4524	440	18ec543ce0b8ea6352af0fd88e667b7de32620eb974f7472cd63767eefd47a4a.exe	82
PID 440 wrote to memory of 4524	440	18ec543ce0b8ea6352af0fd88e667b7de32620eb974f7472cd63767eefd47a4a.exe	82
PID 440 wrote to memory of 4524	440	18ec543ce0b8ea6352af0fd88e667b7de32620eb974f7472cd63767eefd47a4a.exe	82
PID 4524 wrote to memory of 2900	4524	18ec543ce0b8ea6352af0fd88e667b7de32620eb974f7472cd63767eefd47a4a.exe	84
PID 4524 wrote to memory of 2900	4524	18ec543ce0b8ea6352af0fd88e667b7de32620eb974f7472cd63767eefd47a4a.exe	84
PID 4524 wrote to memory of 2900	4524	18ec543ce0b8ea6352af0fd88e667b7de32620eb974f7472cd63767eefd47a4a.exe	84
PID 2900 wrote to memory of 1692	2900	omsecor.exe	86
PID 2900 wrote to memory of 1692	2900	omsecor.exe	86
PID 2900 wrote to memory of 1692	2900	omsecor.exe	86
PID 2900 wrote to memory of 1692	2900	omsecor.exe	86
PID 2900 wrote to memory of 1692	2900	omsecor.exe	86
PID 1692 wrote to memory of 3880	1692	omsecor.exe	97
PID 1692 wrote to memory of 3880	1692	omsecor.exe	97
PID 1692 wrote to memory of 3880	1692	omsecor.exe	97
PID 3880 wrote to memory of 4308	3880	omsecor.exe	98
PID 3880 wrote to memory of 4308	3880	omsecor.exe	98
PID 3880 wrote to memory of 4308	3880	omsecor.exe	98
PID 3880 wrote to memory of 4308	3880	omsecor.exe	98
PID 3880 wrote to memory of 4308	3880	omsecor.exe	98
PID 4308 wrote to memory of 4732	4308	omsecor.exe	100
PID 4308 wrote to memory of 4732	4308	omsecor.exe	100
PID 4308 wrote to memory of 4732	4308	omsecor.exe	100
PID 4732 wrote to memory of 1920	4732	omsecor.exe	102
PID 4732 wrote to memory of 1920	4732	omsecor.exe	102
PID 4732 wrote to memory of 1920	4732	omsecor.exe	102
PID 4732 wrote to memory of 1920	4732	omsecor.exe	102
PID 4732 wrote to memory of 1920	4732	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\18ec543ce0b8ea6352af0fd88e667b7de32620eb974f7472cd63767eefd47a4a.exe
"C:\Users\Admin\AppData\Local\Temp\18ec543ce0b8ea6352af0fd88e667b7de32620eb974f7472cd63767eefd47a4a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:440
- C:\Users\Admin\AppData\Local\Temp\18ec543ce0b8ea6352af0fd88e667b7de32620eb974f7472cd63767eefd47a4a.exe
  C:\Users\Admin\AppData\Local\Temp\18ec543ce0b8ea6352af0fd88e667b7de32620eb974f7472cd63767eefd47a4a.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1692
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3880
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:1920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 256
        8⤵
        Program crash
        
        PID:2852
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 296
        6⤵
        Program crash
        
        PID:4276
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 300
      4⤵
      Program crash
      PID:3904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 300
  2⤵
  - Program crash
  PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 440 -ip 440
1⤵
PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2900 -ip 2900
1⤵
PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3880 -ip 3880
1⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4732 -ip 4732
1⤵
PID:5084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 6c1682cf62b850527c15d71278c48ec8a3ad15de5fcc6a1982db60ddeb472f89
MD5 16d555ad296b07ac4f667deaff6a8b26
SHA1 9048129a0893fe38defe1c8989ed6ba876b4b7e2
SHA512 faeba6ac421243982ab184d1a0fb175b6c2fa9502a5f34108ac66372d08b6d661e169776e9056fa9da25d0758c5a8f6370ef69a45ba505dfb73dee8f95977ca4
SSDEEP 1536:unAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:uGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 ef6fedb2ef54cbe42e737ad42ae0c564d1235bdfea983889e50ba439c05d374e
MD5 7d860f6e3008b03d1496cca4979a1cb9
SHA1 0444ceeaefc74df0587832a60b329482ff27a38d
SHA512 6082b9f0eb724fbe550b9aa52161ab51953926252d92ab5d2bb1849af39738efd5a1df1a2b94721ae5f6cd24b83e01707126cd87e4203bf5e1000a5c02fb0f7b
SSDEEP 1536:KnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:KGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 5cd503a14b3c30ba66a7e403659d09e7dfb2fec37ec1962afdee8875ba2234e2
MD5 bbd04b8adc911cde3a3f1af9f59bb085
SHA1 6793c95ede1bea2e1d4c28db5d025f8aebb92fe9
SHA512 ccf82e15c4bae43fffb207b0a73ca57ee7ff9a7564e39b655c20f9ce98032c1ca3a9e7157c14f050689ca7c2d1981e25749b757d5ebc68282c6e56f04fde7ef6
SSDEEP 1536:RnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:RGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/440-18-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/440-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1692-31-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1692-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1692-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1692-16-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1692-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1692-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1692-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1920-57-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1920-59-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1920-55-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1920-53-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1920-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1920-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2900-12-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3880-51-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3880-32-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4308-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4308-39-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4308-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4524-4-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4524-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4524-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4524-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4732-44-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads