neconyd | 337ee8bbfdb4ad2f8d12da1468403040188d4fe9403e6abb0545f86f11874f8e

Analysis

max time kernel
111s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c66e0a4153710056801f0726d5243c50N.exe
Size 134KB
Sample240715-mngmqsvdmd
SHA256 337ee8bbfdb4ad2f8d12da1468403040188d4fe9403e6abb0545f86f11874f8e
MD5 c66e0a4153710056801f0726d5243c50
SHA1 823c2cca7abce937c0aeb01583c7875ddfd7087a
SHA512 9d4b09b31867a3a5db33213befbebc333cb9c88b7f2e9bc469150805882318d71ebebc128f668a90306e1d2c8c1bb302bd488080d84475e087adc744f7ef881d
SSDEEP 1536:uDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:QiRTeH0NqAW6J6f1tqF6dngNmaZC7M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
4560	omsecor.exe
4744	omsecor.exe
1548	omsecor.exe
376	omsecor.exe
3008	omsecor.exe
3164	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2816 set thread context of 2468	2816	c66e0a4153710056801f0726d5243c50N.exe	83
PID 4560 set thread context of 4744	4560	omsecor.exe	88
PID 1548 set thread context of 376	1548	omsecor.exe	98
PID 3008 set thread context of 3164	3008	omsecor.exe	102

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2356	4560	WerFault.exe	86
5040	2816	WerFault.exe	82
4808	1548	WerFault.exe	97
648	3008	WerFault.exe	100

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2468	2816	c66e0a4153710056801f0726d5243c50N.exe	83
PID 2816 wrote to memory of 2468	2816	c66e0a4153710056801f0726d5243c50N.exe	83
PID 2816 wrote to memory of 2468	2816	c66e0a4153710056801f0726d5243c50N.exe	83
PID 2816 wrote to memory of 2468	2816	c66e0a4153710056801f0726d5243c50N.exe	83
PID 2816 wrote to memory of 2468	2816	c66e0a4153710056801f0726d5243c50N.exe	83
PID 2468 wrote to memory of 4560	2468	c66e0a4153710056801f0726d5243c50N.exe	86
PID 2468 wrote to memory of 4560	2468	c66e0a4153710056801f0726d5243c50N.exe	86
PID 2468 wrote to memory of 4560	2468	c66e0a4153710056801f0726d5243c50N.exe	86
PID 4560 wrote to memory of 4744	4560	omsecor.exe	88
PID 4560 wrote to memory of 4744	4560	omsecor.exe	88
PID 4560 wrote to memory of 4744	4560	omsecor.exe	88
PID 4560 wrote to memory of 4744	4560	omsecor.exe	88
PID 4560 wrote to memory of 4744	4560	omsecor.exe	88
PID 4744 wrote to memory of 1548	4744	omsecor.exe	97
PID 4744 wrote to memory of 1548	4744	omsecor.exe	97
PID 4744 wrote to memory of 1548	4744	omsecor.exe	97
PID 1548 wrote to memory of 376	1548	omsecor.exe	98
PID 1548 wrote to memory of 376	1548	omsecor.exe	98
PID 1548 wrote to memory of 376	1548	omsecor.exe	98
PID 1548 wrote to memory of 376	1548	omsecor.exe	98
PID 1548 wrote to memory of 376	1548	omsecor.exe	98
PID 376 wrote to memory of 3008	376	omsecor.exe	100
PID 376 wrote to memory of 3008	376	omsecor.exe	100
PID 376 wrote to memory of 3008	376	omsecor.exe	100
PID 3008 wrote to memory of 3164	3008	omsecor.exe	102
PID 3008 wrote to memory of 3164	3008	omsecor.exe	102
PID 3008 wrote to memory of 3164	3008	omsecor.exe	102
PID 3008 wrote to memory of 3164	3008	omsecor.exe	102
PID 3008 wrote to memory of 3164	3008	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\c66e0a4153710056801f0726d5243c50N.exe
"C:\Users\Admin\AppData\Local\Temp\c66e0a4153710056801f0726d5243c50N.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\c66e0a4153710056801f0726d5243c50N.exe
  C:\Users\Admin\AppData\Local\Temp\c66e0a4153710056801f0726d5243c50N.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4744
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1548
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:376
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 256
        8⤵
        Program crash
        
        PID:648
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 292
        6⤵
        Program crash
        
        PID:4808
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 272
      4⤵
      Program crash
      PID:2356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 256
  2⤵
  - Program crash
  PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2816 -ip 2816
1⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4560 -ip 4560
1⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1548 -ip 1548
1⤵
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3008 -ip 3008
1⤵
PID:5032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 87346ab44163e14e282b423401d3119f7c138ee2a8596764b6724caea0ccd20c
MD5 ca02ae74f48adac58e085869c704eef1
SHA1 a5bb8345873fdf865ba5de2be7b501d5b64bd7e2
SHA512 8caa2625c15c636b3a2ee7ad19e9331cffbe6ea7fdbc64558d387b3fcc763ed9a4c502ab2185eb7d9cdaa3a9d7953c3309fd731bf0223f903d7612c3b30bff79
SSDEEP 1536:iDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:UiRTeH0NqAW6J6f1tqF6dngNmaZC7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 6154859aba06b0b3b445c7a7ecb974bb1b122bc45f548abdb52eec94867fcb90
MD5 96a6bd25a542a0e9b076641bdd3db517
SHA1 7b80f7157da077ced640d1fffb1a3a751eccb0b4
SHA512 de9086196407cbe4e64df80fca6a9d53a98fdd65c29e62598519eb4cd16f1815e2be97febafbbfe01d6f7f912f2e16f3b5a98fd7e9c89cdf484714bf5d780ef8
SSDEEP 1536:WDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:IiRTeH0NqAW6J6f1tqF6dngNmaZC7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 134KB
SHA256 67fb5bcc75b8d9bc90a00379674765969269e3bf09ef253fceb5987ffc643a8c
MD5 cc411d7faa0092754da84e5cca133fc4
SHA1 8f05c1212c53b33f6d1fe20ab73c8ed37f35f0eb
SHA512 a04cec1c74e2d8f769443c34480273acec6e6c0fa720f62f655d7826069325a22d1ad03324f8642a01ef0cae7d39f6044611e333b9e4c67014b2d19042a3df3d
SSDEEP 1536:CDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:0iRTeH0NqAW6J6f1tqF6dngNmaZC7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/376-38-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/376-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/376-35-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1548-50-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1548-32-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2468-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2468-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2468-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2468-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2816-17-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2816-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3008-43-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3164-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3164-47-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3164-51-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4560-10-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4560-16-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4744-28-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4744-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4744-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4744-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4744-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4744-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4744-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads