neconyd | 14d40c4090dc2b6b68d3db9e94b0fde889c5fe437fafbc0cd3aa73de39d5dbd4

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2024, 21:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0fc1e92440306d3dc9041c83ba272ba0N.exe
Size 35KB
Sample240717-1akdcstbmg
SHA256 14d40c4090dc2b6b68d3db9e94b0fde889c5fe437fafbc0cd3aa73de39d5dbd4
MD5 0fc1e92440306d3dc9041c83ba272ba0
SHA1 bf6c133858d2e508aca006920519629f08d0b1eb
SHA512 29e292e10f6284bdb300eb564adbacbbb137a7f891d4bd69c1253eda318e693ecfea7c4a50b03c63247311d1c8bd121b36d24ac2328e41b3666500bcec260cef
SSDEEP 768:n6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:68Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2444	omsecor.exe
748	omsecor.exe
4108	omsecor.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3856-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x00080000000234ca-3.dat	upx
behavioral2/memory/2444-4-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/3856-7-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2444-8-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2444-11-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2444-14-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2444-15-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x00090000000234e1-18.dat	upx
behavioral2/memory/2444-21-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/748-22-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/748-26-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x00080000000234ca-27.dat	upx
behavioral2/memory/4108-28-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4108-30-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 2444	3856	0fc1e92440306d3dc9041c83ba272ba0N.exe	84
PID 3856 wrote to memory of 2444	3856	0fc1e92440306d3dc9041c83ba272ba0N.exe	84
PID 3856 wrote to memory of 2444	3856	0fc1e92440306d3dc9041c83ba272ba0N.exe	84
PID 2444 wrote to memory of 748	2444	omsecor.exe	99
PID 2444 wrote to memory of 748	2444	omsecor.exe	99
PID 2444 wrote to memory of 748	2444	omsecor.exe	99
PID 748 wrote to memory of 4108	748	omsecor.exe	100
PID 748 wrote to memory of 4108	748	omsecor.exe	100
PID 748 wrote to memory of 4108	748	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\0fc1e92440306d3dc9041c83ba272ba0N.exe
"C:\Users\Admin\AppData\Local\Temp\0fc1e92440306d3dc9041c83ba272ba0N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:748
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 f52868db73f83c75229a78ce539bbc0e4e59b8ab526b946b603dfbd43ce73a55
MD5 090b3b8f53bb5a92d7fc4cd109699168
SHA1 87b2d161e71d4cc6b255f1f998a84d9c5285625e
SHA512 93dfbb54af248eab11053282804de5ab524d526780fafcf508f4d22809dc2548a3f952dcea02971dc75b146fe0d321073516d73f58059fedbae63c73fddd0591
SSDEEP 768:l6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:o8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 1723c54ae6abcbb9472f3621af25ee8c0ade1dd0a0d345093545f208724d6688
MD5 38eec742d516fdce68e0576043517308
SHA1 92a681eb88a1bd0e76753a45d49df1e30440e511
SHA512 085e70c0e0a2c3248b24ad437e21839a90b51137fcefb06fb8fd2eb510488c6dbbb138866c5fd4798b24f9ddf5f31eb580558918a2ba8faa76b7cec47f591182
SSDEEP 768:T6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:O8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 35KB
SHA256 78c5d2f2ec211301ecf2e96b210ff9b625c206ff98b8f5fd1fb9ef25d6465b25
MD5 682ca0e753e214a7b51fe1143e0d6955
SHA1 6057780a980dbaa2836abb4653cb805627c3cb50
SHA512 652689d9acc76bc52b6a01f36227f8650dd2f79b23ce23579f7f92431ee618289627c47b95e49776a3aedf037f8aa965313cd27a3b955931aa0602ec0a2371af
SSDEEP 768:N6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:A8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/748-26-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/748-22-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2444-21-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2444-14-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2444-15-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2444-11-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2444-8-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2444-4-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3856-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3856-7-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4108-28-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4108-30-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads