neconyd | 24abf19a6366f8f402b0598ee8702b7f06f48a23d2f181d2f2aec71bcbb704a1

Analysis

max time kernel
142s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
24abf19a6366f8f402b0598ee8702b7f06f48a23d2f181d2f2aec71bcbb704a1.exe
Size 88KB
Sample240706-ydzakstejg
SHA256 24abf19a6366f8f402b0598ee8702b7f06f48a23d2f181d2f2aec71bcbb704a1
MD5 4361ae02298b144a7109d7f341507134
SHA1 1b9a89a74593738bd89848e81e333c3a1459446e
SHA512 b4e99396227708893ca1c28789db9b5f4f6af98cd7eb332844b64aae1b3b6f988ce2287dddff20b3987a623e88f80911725e62c8736fd4fa3aca910b766508a5
SSDEEP 1536:wd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:wdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
5104	omsecor.exe
3904	omsecor.exe
2200	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 5104	448	24abf19a6366f8f402b0598ee8702b7f06f48a23d2f181d2f2aec71bcbb704a1.exe	80
PID 448 wrote to memory of 5104	448	24abf19a6366f8f402b0598ee8702b7f06f48a23d2f181d2f2aec71bcbb704a1.exe	80
PID 448 wrote to memory of 5104	448	24abf19a6366f8f402b0598ee8702b7f06f48a23d2f181d2f2aec71bcbb704a1.exe	80
PID 5104 wrote to memory of 3904	5104	omsecor.exe	90
PID 5104 wrote to memory of 3904	5104	omsecor.exe	90
PID 5104 wrote to memory of 3904	5104	omsecor.exe	90
PID 3904 wrote to memory of 2200	3904	omsecor.exe	91
PID 3904 wrote to memory of 2200	3904	omsecor.exe	91
PID 3904 wrote to memory of 2200	3904	omsecor.exe	91

C:\Users\Admin\AppData\Local\Temp\24abf19a6366f8f402b0598ee8702b7f06f48a23d2f181d2f2aec71bcbb704a1.exe
"C:\Users\Admin\AppData\Local\Temp\24abf19a6366f8f402b0598ee8702b7f06f48a23d2f181d2f2aec71bcbb704a1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:448
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 48725f9ed0b2ece845ca96d5189fc2c0bf9a33d3188fbedfa8224b276ee00d8f
MD5 e4d95d1213bd889cb89a00c18d214b58
SHA1 11fc192bfad7a1bc41010e4d1733545bf6939dff
SHA512 e9da3ea9caa850553271de93f617c6c05d2ca08c355f15e331b7a32336d06081ebfa114104798130e3f7e54238e86ef12aa85773d5d64cb662bf28cd43593198
SSDEEP 1536:Id9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:4dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 d740028f0093a2c31e4bc702a65c6308209c4e42f9b90dfb24afdd7aa12836b8
MD5 53ec13f964268313a9397af23747ed20
SHA1 429071a9d566240a86329d5dd25ca6c91c15cc66
SHA512 a1477e13e03b9d1a4fd85c6938839156d857299fc7adcc3f9a4ab1f9c3cfc9ee6ab1b57ebc448c76d3577fe5223af83bcee959359f509b6ab6109dcd4ac12b39
SSDEEP 1536:0d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:MdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 ba21854efa0a8d022d822350c816fd8b17a27a17f78ff53f4e6cc2871c3a239a
MD5 a07167f18644d76b217307649e4032d0
SHA1 fe06b6f6c261eda213d30b112107e7bbf89d6f99
SHA512 ba2c0eb6610b944a884f3041a88b8102460b7ff3cd75f520c535b2dda8da88776ccadf080d67e3112f2ffc07f5ea26eceff2a6c2b0303a0933a750a6ba5f11c0
SSDEEP 1536:nd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:PdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads