neconyd | 1cf217948c252b41df5eeb15c98c065bb89996e82175f337fd388bb08d4413e6

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2024, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
54e7abbb6715adc9c319a3d2aea3e4b0N.exe
Size 96KB
Sample240717-c6d98avfpc
SHA256 1cf217948c252b41df5eeb15c98c065bb89996e82175f337fd388bb08d4413e6
MD5 54e7abbb6715adc9c319a3d2aea3e4b0
SHA1 be70a9902702c463e2d9047f106ce5e3cfdc3b7a
SHA512 20a24f1ee96ab315a028a0afdd68aa14c3e0cf618afdefdcfbee5af9509b807e4d4bcc1755012ef64617a4dfa703887fbbc0ace1d79b9334df0762da45457563
SSDEEP 1536:8nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:8Gs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
4196	omsecor.exe
1084	omsecor.exe
4996	omsecor.exe
4840	omsecor.exe
1864	omsecor.exe
1536	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4832 set thread context of 556	4832	54e7abbb6715adc9c319a3d2aea3e4b0N.exe	84
PID 4196 set thread context of 1084	4196	omsecor.exe	89
PID 4996 set thread context of 4840	4996	omsecor.exe	107
PID 1864 set thread context of 1536	1864	omsecor.exe	111

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4700	4832	WerFault.exe	83
2028	4196	WerFault.exe	87
416	4996	WerFault.exe	106
1424	1864	WerFault.exe	109

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 556	4832	54e7abbb6715adc9c319a3d2aea3e4b0N.exe	84
PID 4832 wrote to memory of 556	4832	54e7abbb6715adc9c319a3d2aea3e4b0N.exe	84
PID 4832 wrote to memory of 556	4832	54e7abbb6715adc9c319a3d2aea3e4b0N.exe	84
PID 4832 wrote to memory of 556	4832	54e7abbb6715adc9c319a3d2aea3e4b0N.exe	84
PID 4832 wrote to memory of 556	4832	54e7abbb6715adc9c319a3d2aea3e4b0N.exe	84
PID 556 wrote to memory of 4196	556	54e7abbb6715adc9c319a3d2aea3e4b0N.exe	87
PID 556 wrote to memory of 4196	556	54e7abbb6715adc9c319a3d2aea3e4b0N.exe	87
PID 556 wrote to memory of 4196	556	54e7abbb6715adc9c319a3d2aea3e4b0N.exe	87
PID 4196 wrote to memory of 1084	4196	omsecor.exe	89
PID 4196 wrote to memory of 1084	4196	omsecor.exe	89
PID 4196 wrote to memory of 1084	4196	omsecor.exe	89
PID 4196 wrote to memory of 1084	4196	omsecor.exe	89
PID 4196 wrote to memory of 1084	4196	omsecor.exe	89
PID 1084 wrote to memory of 4996	1084	omsecor.exe	106
PID 1084 wrote to memory of 4996	1084	omsecor.exe	106
PID 1084 wrote to memory of 4996	1084	omsecor.exe	106
PID 4996 wrote to memory of 4840	4996	omsecor.exe	107
PID 4996 wrote to memory of 4840	4996	omsecor.exe	107
PID 4996 wrote to memory of 4840	4996	omsecor.exe	107
PID 4996 wrote to memory of 4840	4996	omsecor.exe	107
PID 4996 wrote to memory of 4840	4996	omsecor.exe	107
PID 4840 wrote to memory of 1864	4840	omsecor.exe	109
PID 4840 wrote to memory of 1864	4840	omsecor.exe	109
PID 4840 wrote to memory of 1864	4840	omsecor.exe	109
PID 1864 wrote to memory of 1536	1864	omsecor.exe	111
PID 1864 wrote to memory of 1536	1864	omsecor.exe	111
PID 1864 wrote to memory of 1536	1864	omsecor.exe	111
PID 1864 wrote to memory of 1536	1864	omsecor.exe	111
PID 1864 wrote to memory of 1536	1864	omsecor.exe	111

C:\Users\Admin\AppData\Local\Temp\54e7abbb6715adc9c319a3d2aea3e4b0N.exe
"C:\Users\Admin\AppData\Local\Temp\54e7abbb6715adc9c319a3d2aea3e4b0N.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\54e7abbb6715adc9c319a3d2aea3e4b0N.exe
  C:\Users\Admin\AppData\Local\Temp\54e7abbb6715adc9c319a3d2aea3e4b0N.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1084
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4996
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:1536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 256
        8⤵
        Program crash
        
        PID:1424
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 292
        6⤵
        Program crash
        
        PID:416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 300
      4⤵
      Program crash
      PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 272
  2⤵
  - Program crash
  PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4832 -ip 4832
1⤵
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4196 -ip 4196
1⤵
PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4996 -ip 4996
1⤵
PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1864 -ip 1864
1⤵
PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 ba6d86629e530d9936c34430f3101855cdb7fc03a563ab80473d352eee382b70
MD5 61408e811935236d5f9b3014f6ec937a
SHA1 4b4991859fb5cfe4ee5e5758a8e78ea9f8fd4b4e
SHA512 12d36f3a7cab05093b31b93330fc0905bfa133fbc16eca0f80e10a1247a3d0ff3b520182bb9180aa487b4eb4a4e4bad883cc8f3c6a43eb606a4543b1a26c2301
SSDEEP 1536:znAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:zGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 2ad57888044489afa35c51261a42596a31cf8be48e7485b902deaba7d01ef1bf
MD5 740e2e085f22f9b3da5a1a07a71663d8
SHA1 a01d8adb286e255b5ccd2c6c92592a685b779e75
SHA512 bf323e36a10f4719791968a1e48212cf1640121a1ab2653149c4563855ce93c35dda6458ee05d2c26edd1332ea7b8a09418d74bb550e123f7f03f31b8f77c86f
SSDEEP 1536:8nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:8Gs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 5335985801f952ec3d064b29e9e2ab598e794718d1f3b643cb523de5045445ab
MD5 994deb4ae13ecd314753bff2c8ab1648
SHA1 e453bc49b7ef2c864928f2510d90eb87ccb58133
SHA512 6647e96f58bea4a92bf69a70dafc699295bb75a661cc86dc012da471c01c7b298925d35d499c0bc95b41324cc3e6b8f5d9e5fa6140cfa3876c47e83b4dbcdb4b
SSDEEP 1536:EnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:EGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/556-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/556-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/556-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/556-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1084-16-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1084-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1084-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1084-27-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1084-28-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1084-35-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1084-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1536-51-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1536-52-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1536-55-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1864-47-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1864-54-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4196-10-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4196-20-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4832-18-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4832-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4840-40-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4840-45-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4840-39-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4996-36-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads