neconyd | 9be412bfec9837334bcdad02b1e5eb1f0a8d12ad862149964345ee018fce324b

Analysis

max time kernel
114s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b11d24ae8331cd90dedd6ebb35081b50N.exe
Size 84KB
Sample240716-nd8txasfja
SHA256 9be412bfec9837334bcdad02b1e5eb1f0a8d12ad862149964345ee018fce324b
MD5 b11d24ae8331cd90dedd6ebb35081b50
SHA1 f1ac761a56d0e4261a5d71776ee18e35c1665116
SHA512 c9db75233a455f24ef6c01d33e9989681e4a8eaf04da6781da1ba61aed7b0ea56e2512c47ae0da86227eed77e79a8058113c43704937b8ef05b4f278ba7ad8ec
SSDEEP 1536:fd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:XdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4540	omsecor.exe
3016	omsecor.exe
756	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 4540	1384	b11d24ae8331cd90dedd6ebb35081b50N.exe	83
PID 1384 wrote to memory of 4540	1384	b11d24ae8331cd90dedd6ebb35081b50N.exe	83
PID 1384 wrote to memory of 4540	1384	b11d24ae8331cd90dedd6ebb35081b50N.exe	83
PID 4540 wrote to memory of 3016	4540	omsecor.exe	90
PID 4540 wrote to memory of 3016	4540	omsecor.exe	90
PID 4540 wrote to memory of 3016	4540	omsecor.exe	90
PID 3016 wrote to memory of 756	3016	omsecor.exe	91
PID 3016 wrote to memory of 756	3016	omsecor.exe	91
PID 3016 wrote to memory of 756	3016	omsecor.exe	91

C:\Users\Admin\AppData\Local\Temp\b11d24ae8331cd90dedd6ebb35081b50N.exe
"C:\Users\Admin\AppData\Local\Temp\b11d24ae8331cd90dedd6ebb35081b50N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 4683e70c2ee877ca5bf513241455307c6128666df6298b004a5cb7d76c6e21af
MD5 a9631682b4d382c74a439d0e57fe7b7b
SHA1 a1a77073b92c12150551a6be185f68be2d611303
SHA512 fb712b79657f4aa624b337b1088aee7796d70ee43aa6780001910f74d39bcc64491c949549dd9b0aaa47b61d508ba92f97e2c742b1729b6eb1ee3c881a91a449
SSDEEP 1536:dd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:VdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 4ff5d078f3fa7c2eb243881b14412f13bf76c8c41903fd6fb21a7f527b398082
MD5 cbcc4c548946f77b7297233c59347adf
SHA1 a88d0b2c34ebe9b69a1a52efe6f236072a98e19c
SHA512 f663822d542310b4bbad4d3f0c47cce7cc9eb4947c8d3721c6797beba82dc3ededbe762ccaa0ab0d20292f45ba6a51aeb40f90f33a2a0b7d37b56813a27fd433
SSDEEP 1536:Xd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:fdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 1bc13e5115e4a65938bf2b39a1f140fdbdd2e3608436afad2a264538246dcd43
MD5 a2926b134ed3d4efa42557d6c2198665
SHA1 90fe44f5297263999c7a3b1a342d103e59e8861c
SHA512 796fe5f1712e98f6697fa84a7d2a2277987af3a652b04817ac08c512a308e4f14b1964fd7f3cd64287fca39bbc87f1ba8d038efa99f44282ef1b31f627bddcd8
SSDEEP 1536:Jd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:JdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads