neconyd | e19b66c00d537a828947d68b8ca99a16b5aad6706977cc9bdfce360ec6f1072d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e19b66c00d537a828947d68b8ca99a16b5aad6706977cc9bdfce360ec6f1072d.exe
Size 76KB
Sample240706-eeccnaxenf
SHA256 e19b66c00d537a828947d68b8ca99a16b5aad6706977cc9bdfce360ec6f1072d
MD5 ce078f67e66d3fba264b7ae5b5f1ef94
SHA1 636580a1795ca4938020ce2e890ab7d4f4f81dc8
SHA512 a2715295e4b9437967fb5461e123207ae6f62794d0b266428ee4a4711bcc3ee40bd784204682254e21963d602171a795a977160802095377e8adfcd0791e77c1
SSDEEP 768:8MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:8bIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2332	omsecor.exe
3620	omsecor.exe
4900	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 2332	4424	e19b66c00d537a828947d68b8ca99a16b5aad6706977cc9bdfce360ec6f1072d.exe	83
PID 4424 wrote to memory of 2332	4424	e19b66c00d537a828947d68b8ca99a16b5aad6706977cc9bdfce360ec6f1072d.exe	83
PID 4424 wrote to memory of 2332	4424	e19b66c00d537a828947d68b8ca99a16b5aad6706977cc9bdfce360ec6f1072d.exe	83
PID 2332 wrote to memory of 3620	2332	omsecor.exe	89
PID 2332 wrote to memory of 3620	2332	omsecor.exe	89
PID 2332 wrote to memory of 3620	2332	omsecor.exe	89
PID 3620 wrote to memory of 4900	3620	omsecor.exe	90
PID 3620 wrote to memory of 4900	3620	omsecor.exe	90
PID 3620 wrote to memory of 4900	3620	omsecor.exe	90

C:\Users\Admin\AppData\Local\Temp\e19b66c00d537a828947d68b8ca99a16b5aad6706977cc9bdfce360ec6f1072d.exe
"C:\Users\Admin\AppData\Local\Temp\e19b66c00d537a828947d68b8ca99a16b5aad6706977cc9bdfce360ec6f1072d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3620
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 f903f9bf3b862300b89550669b0115c6e476c23925158b220e9c9c9a867bcdaa
MD5 d8032f2a329af692875c743be510a1a1
SHA1 10b65dbdf6d4bd82242fdc7a09ebb2dd821369be
SHA512 d43a4fcf3d9c451a3cb9d95d51b45fd60b579291bbdf0127482e1fd6925af1dab9dc2ad5de601e391a6823e43ea47730401d0020c64a6ea85243b5627222edb0
SSDEEP 768:aMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:abIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 c6735d6105a68ed62a57c392708b81af9ec7667685584824432090758a2a227f
MD5 6c7bef6c57bfd36245a3dbbac64c4dbe
SHA1 0a62d90b541d2f4344c1818f6e3d111b314459c7
SHA512 039a5b6fb99baeb52d62b75c9badb45d1a61fa49ca050bcd26e02d78d68c8514e7d04d2748729499f13bfce3c7cca4467192af566c26b7a1da59138143bbb2b6
SSDEEP 768:AMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:AbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 a7bbc3361d9e48b2ce359aa0ea23e01279ea275f8a6d55fa4164f04fb7512932
MD5 60c20cb0899a259e0d659601e860f8bb
SHA1 c4b3227a519e3b7c2b6bcd5132c8b9faa835b144
SHA512 8597fb81d545ab610bb21398cbc287c0048295bac8927e0d17ccebafb3caa6c770fcadcce2340a4aa7993aa35b157fe95215ff11bdf4aa342e047a7198d11b6a
SSDEEP 768:iMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:ibIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads