neconyd | 5afc6cb8ed3ce622f1316170d018ec673398e7a5629175bc06ed63eab904f23e

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c0d2e4f2e7ab7e5aa198355208a98c0N.exe
Size 134KB
Sample240719-ec2vjavbrh
SHA256 5afc6cb8ed3ce622f1316170d018ec673398e7a5629175bc06ed63eab904f23e
MD5 4c0d2e4f2e7ab7e5aa198355208a98c0
SHA1 1dd89aaff76a2f406f7985871a6acf83c3d08940
SHA512 58d03c6723634e5f00faec255026169ff161ffc96ce6d16d9825a3b969700398e7868ed6bbc1d435bbd1b4f416966822c2df8e48227db8b3589140d224f5d33d
SSDEEP 1536:PDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:7iRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
4608	omsecor.exe
5016	omsecor.exe
4132	omsecor.exe
644	omsecor.exe
3876	omsecor.exe
2920	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2392 set thread context of 4980	2392	4c0d2e4f2e7ab7e5aa198355208a98c0N.exe	84
PID 4608 set thread context of 5016	4608	omsecor.exe	90
PID 4132 set thread context of 644	4132	omsecor.exe	108
PID 3876 set thread context of 2920	3876	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2856	2392	WerFault.exe	83
4552	4608	WerFault.exe	87
2140	4132	WerFault.exe	107
3096	3876	WerFault.exe	110

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 4980	2392	4c0d2e4f2e7ab7e5aa198355208a98c0N.exe	84
PID 2392 wrote to memory of 4980	2392	4c0d2e4f2e7ab7e5aa198355208a98c0N.exe	84
PID 2392 wrote to memory of 4980	2392	4c0d2e4f2e7ab7e5aa198355208a98c0N.exe	84
PID 2392 wrote to memory of 4980	2392	4c0d2e4f2e7ab7e5aa198355208a98c0N.exe	84
PID 2392 wrote to memory of 4980	2392	4c0d2e4f2e7ab7e5aa198355208a98c0N.exe	84
PID 4980 wrote to memory of 4608	4980	4c0d2e4f2e7ab7e5aa198355208a98c0N.exe	87
PID 4980 wrote to memory of 4608	4980	4c0d2e4f2e7ab7e5aa198355208a98c0N.exe	87
PID 4980 wrote to memory of 4608	4980	4c0d2e4f2e7ab7e5aa198355208a98c0N.exe	87
PID 4608 wrote to memory of 5016	4608	omsecor.exe	90
PID 4608 wrote to memory of 5016	4608	omsecor.exe	90
PID 4608 wrote to memory of 5016	4608	omsecor.exe	90
PID 4608 wrote to memory of 5016	4608	omsecor.exe	90
PID 4608 wrote to memory of 5016	4608	omsecor.exe	90
PID 5016 wrote to memory of 4132	5016	omsecor.exe	107
PID 5016 wrote to memory of 4132	5016	omsecor.exe	107
PID 5016 wrote to memory of 4132	5016	omsecor.exe	107
PID 4132 wrote to memory of 644	4132	omsecor.exe	108
PID 4132 wrote to memory of 644	4132	omsecor.exe	108
PID 4132 wrote to memory of 644	4132	omsecor.exe	108
PID 4132 wrote to memory of 644	4132	omsecor.exe	108
PID 4132 wrote to memory of 644	4132	omsecor.exe	108
PID 644 wrote to memory of 3876	644	omsecor.exe	110
PID 644 wrote to memory of 3876	644	omsecor.exe	110
PID 644 wrote to memory of 3876	644	omsecor.exe	110
PID 3876 wrote to memory of 2920	3876	omsecor.exe	112
PID 3876 wrote to memory of 2920	3876	omsecor.exe	112
PID 3876 wrote to memory of 2920	3876	omsecor.exe	112
PID 3876 wrote to memory of 2920	3876	omsecor.exe	112
PID 3876 wrote to memory of 2920	3876	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\4c0d2e4f2e7ab7e5aa198355208a98c0N.exe
"C:\Users\Admin\AppData\Local\Temp\4c0d2e4f2e7ab7e5aa198355208a98c0N.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Users\Admin\AppData\Local\Temp\4c0d2e4f2e7ab7e5aa198355208a98c0N.exe
  C:\Users\Admin\AppData\Local\Temp\4c0d2e4f2e7ab7e5aa198355208a98c0N.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:5016
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4132
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:644
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 256
        8⤵
        Program crash
        
        PID:3096
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 296
        6⤵
        Program crash
        
        PID:2140
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 300
      4⤵
      Program crash
      PID:4552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 300
  2⤵
  - Program crash
  PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2392 -ip 2392
1⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4608 -ip 4608
1⤵
PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4132 -ip 4132
1⤵
PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3876 -ip 3876
1⤵
PID:4932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 e55cc453130132acbd841eb3421ab8a51e26cb928f85355a9db5d9bb588b0c61
MD5 ccba5379b9f050f8329abddc7d7e5c9f
SHA1 f4550103444a64d5d66977c3f42c850bc315a759
SHA512 3816f70ddee6ec4f3a0f624cb1f577011b722df196b37dd9576ecc921aa577a29f5d0add448c4df9aea1cd8a8920a2c2b1cc5ad4c50981a39b488141ac300abf
SSDEEP 1536:lDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:FiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 dfae2d77a2fa757d9f4d40a04b6a1ba288cd7a67e827b0d71ce476d9e12739de
MD5 de3b2cdf036d3f9fc8613d4b213f3b96
SHA1 1d882e9820bc02d6f7e10b77387c7de6ded7a481
SHA512 a7e5fb304b560fa53006a17577bcd2f595144f08389c1fe3ca2f25da1faca93695691f10e4d77ff45ff584853e1b38d6a24c3c9e26d9228b54d5dc6dbe31b145
SSDEEP 1536:yDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:kiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 134KB
SHA256 64b9218f9d3b038a1593b553ce6bd89b9a0ca2cf04de792975fca3f330f06aa3
MD5 d32bcd3b095578fde000ead72eef27e5
SHA1 b765be8b287d4fabf9b9689199e5043e3c1028e4
SHA512 762244ab31a57d2ade30e97bc37f44eb6115366a22f1ebfd7ef982975cffb5b3419b82b0dfea33b48bf7b4c3dce95830cedb9e89caf63418bdc73d03205882d5
SSDEEP 1536:dDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:tiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/644-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/644-35-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/644-41-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2392-17-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2392-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2920-47-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2920-51-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2920-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3876-42-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3876-50-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4132-49-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4132-32-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4608-16-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4608-8-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4980-7-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4980-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4980-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4980-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5016-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5016-29-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5016-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5016-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5016-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5016-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5016-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads