neconyd | 4998343f07187a8b3758f7bf1c105b8d6c0692159beaa0303a15005e34b2db82

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3a89b37093f6a7919926869a6f266c70N.exe
Size 134KB
Sample240716-aw2awszbqf
SHA256 4998343f07187a8b3758f7bf1c105b8d6c0692159beaa0303a15005e34b2db82
MD5 3a89b37093f6a7919926869a6f266c70
SHA1 d19a711f6412a0a41e8a10d188e3a2d951f16299
SHA512 5f1e904fcb8a26dee71f027693410bdee67a29ee5884de7a846fe60b9dc933ee022f1bea298e4bf3bff7d1d6155e5db1943368521779da1c0a8f17da57ee3dd7
SSDEEP 1536:2DfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:oiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
2312	omsecor.exe
3584	omsecor.exe
5028	omsecor.exe
2636	omsecor.exe
4368	omsecor.exe
1888	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4240 set thread context of 1552	4240	3a89b37093f6a7919926869a6f266c70N.exe	83
PID 2312 set thread context of 3584	2312	omsecor.exe	88
PID 5028 set thread context of 2636	5028	omsecor.exe	99
PID 4368 set thread context of 1888	4368	omsecor.exe	103

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1560	4240	WerFault.exe	82
3884	2312	WerFault.exe	86
2236	5028	WerFault.exe	98
4152	4368	WerFault.exe	101

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 1552	4240	3a89b37093f6a7919926869a6f266c70N.exe	83
PID 4240 wrote to memory of 1552	4240	3a89b37093f6a7919926869a6f266c70N.exe	83
PID 4240 wrote to memory of 1552	4240	3a89b37093f6a7919926869a6f266c70N.exe	83
PID 4240 wrote to memory of 1552	4240	3a89b37093f6a7919926869a6f266c70N.exe	83
PID 4240 wrote to memory of 1552	4240	3a89b37093f6a7919926869a6f266c70N.exe	83
PID 1552 wrote to memory of 2312	1552	3a89b37093f6a7919926869a6f266c70N.exe	86
PID 1552 wrote to memory of 2312	1552	3a89b37093f6a7919926869a6f266c70N.exe	86
PID 1552 wrote to memory of 2312	1552	3a89b37093f6a7919926869a6f266c70N.exe	86
PID 2312 wrote to memory of 3584	2312	omsecor.exe	88
PID 2312 wrote to memory of 3584	2312	omsecor.exe	88
PID 2312 wrote to memory of 3584	2312	omsecor.exe	88
PID 2312 wrote to memory of 3584	2312	omsecor.exe	88
PID 2312 wrote to memory of 3584	2312	omsecor.exe	88
PID 3584 wrote to memory of 5028	3584	omsecor.exe	98
PID 3584 wrote to memory of 5028	3584	omsecor.exe	98
PID 3584 wrote to memory of 5028	3584	omsecor.exe	98
PID 5028 wrote to memory of 2636	5028	omsecor.exe	99
PID 5028 wrote to memory of 2636	5028	omsecor.exe	99
PID 5028 wrote to memory of 2636	5028	omsecor.exe	99
PID 5028 wrote to memory of 2636	5028	omsecor.exe	99
PID 5028 wrote to memory of 2636	5028	omsecor.exe	99
PID 2636 wrote to memory of 4368	2636	omsecor.exe	101
PID 2636 wrote to memory of 4368	2636	omsecor.exe	101
PID 2636 wrote to memory of 4368	2636	omsecor.exe	101
PID 4368 wrote to memory of 1888	4368	omsecor.exe	103
PID 4368 wrote to memory of 1888	4368	omsecor.exe	103
PID 4368 wrote to memory of 1888	4368	omsecor.exe	103
PID 4368 wrote to memory of 1888	4368	omsecor.exe	103
PID 4368 wrote to memory of 1888	4368	omsecor.exe	103

C:\Users\Admin\AppData\Local\Temp\3a89b37093f6a7919926869a6f266c70N.exe
"C:\Users\Admin\AppData\Local\Temp\3a89b37093f6a7919926869a6f266c70N.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Users\Admin\AppData\Local\Temp\3a89b37093f6a7919926869a6f266c70N.exe
  C:\Users\Admin\AppData\Local\Temp\3a89b37093f6a7919926869a6f266c70N.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3584
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:5028
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:1888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 268
        8⤵
        Program crash
        
        PID:4152
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 292
        6⤵
        Program crash
        
        PID:2236
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 288
      4⤵
      Program crash
      PID:3884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 288
  2⤵
  - Program crash
  PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4240 -ip 4240
1⤵
PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2312 -ip 2312
1⤵
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5028 -ip 5028
1⤵
PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4368 -ip 4368
1⤵
PID:3860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 1b856c7f6dfb5e3fc86c98ad2f3e32724a1e2aa67d976aeb8455244b5f838fab
MD5 199d050616f68aeff0a86305824dd038
SHA1 a22353e732f3249919e6685c8193ddaf07026416
SHA512 30b7d7a2cc103cee07214b7d3e31f1c6686d7c7efef44a5108ff154eb11bbd10ced9a05293c8ed892befba00b70d478461970374961daa72a414d238aea318d6
SSDEEP 1536:iDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:UiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 489ad69dc6b19b2063ee2ef0f860fc55650be41860aa003144e121588378d29d
MD5 b454c929a5feb091124125b7a4dcc127
SHA1 41e67957751f6d1ca513f73a0d25e2f8a60c8683
SHA512 4870482724be60273cebe6484366ad9c29db82811e1ff77761b2569e4e6d4397e619a7d2c6bd446b267271ead7fec4a77678fd4891022d7248650cd1b12050ef
SSDEEP 1536:aDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:8iRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 134KB
SHA256 ede5ffaddfcfe717ca880e8f0bad12b74ed88eca518705cf60e46f69aae605c7
MD5 c2e34dbe64bb263e25cbf52219aaaf9e
SHA1 7ba5706dc10ddd11fbf4afef860309f252420a32
SHA512 aa69fa341c06e2313c55534ddf16e3f9bfbc5e20820fc66f27f84b40c0facad24b8f745328a5c83aa459323e2f91bea0dbe07d9fe6e0f03a2e87812cabea2c73
SSDEEP 1536:ODfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:wiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1552-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1552-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1552-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1552-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1888-51-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1888-50-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1888-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2312-10-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2312-17-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2636-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2636-38-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2636-40-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-33-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-16-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4240-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4240-18-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4368-45-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5028-34-0x0000000000400000-0x0000000000424000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads