neconyd | f3046648449f626dff90090313cf222369bd72ac454c39935b68e87ef1247932

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3a1e84878623ec461fbbfe0b1f6352a0N.exe
Size 96KB
Sample240721-bae17steml
SHA256 f3046648449f626dff90090313cf222369bd72ac454c39935b68e87ef1247932
MD5 3a1e84878623ec461fbbfe0b1f6352a0
SHA1 9e717da749261c8e3a89bd96c71f4023d65cef2b
SHA512 ce1b707a4eadc1dfb5b940ccbb5e6fd55d2a568ec0b735519676c3cec6bf232fcd6d67b8171f82ebde4c3d80c14a3318e72b394015be622d5ca89576a19e066a
SSDEEP 1536:enAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:eGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
1376	omsecor.exe
1436	omsecor.exe
4856	omsecor.exe
4608	omsecor.exe
1368	omsecor.exe
4168	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4832 set thread context of 1736	4832	3a1e84878623ec461fbbfe0b1f6352a0N.exe	85
PID 1376 set thread context of 1436	1376	omsecor.exe	90
PID 4856 set thread context of 4608	4856	omsecor.exe	110
PID 1368 set thread context of 4168	1368	omsecor.exe	114

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1504	4832	WerFault.exe	84
2432	1376	WerFault.exe	88
3964	4856	WerFault.exe	109
3468	1368	WerFault.exe	112

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 1736	4832	3a1e84878623ec461fbbfe0b1f6352a0N.exe	85
PID 4832 wrote to memory of 1736	4832	3a1e84878623ec461fbbfe0b1f6352a0N.exe	85
PID 4832 wrote to memory of 1736	4832	3a1e84878623ec461fbbfe0b1f6352a0N.exe	85
PID 4832 wrote to memory of 1736	4832	3a1e84878623ec461fbbfe0b1f6352a0N.exe	85
PID 4832 wrote to memory of 1736	4832	3a1e84878623ec461fbbfe0b1f6352a0N.exe	85
PID 1736 wrote to memory of 1376	1736	3a1e84878623ec461fbbfe0b1f6352a0N.exe	88
PID 1736 wrote to memory of 1376	1736	3a1e84878623ec461fbbfe0b1f6352a0N.exe	88
PID 1736 wrote to memory of 1376	1736	3a1e84878623ec461fbbfe0b1f6352a0N.exe	88
PID 1376 wrote to memory of 1436	1376	omsecor.exe	90
PID 1376 wrote to memory of 1436	1376	omsecor.exe	90
PID 1376 wrote to memory of 1436	1376	omsecor.exe	90
PID 1376 wrote to memory of 1436	1376	omsecor.exe	90
PID 1376 wrote to memory of 1436	1376	omsecor.exe	90
PID 1436 wrote to memory of 4856	1436	omsecor.exe	109
PID 1436 wrote to memory of 4856	1436	omsecor.exe	109
PID 1436 wrote to memory of 4856	1436	omsecor.exe	109
PID 4856 wrote to memory of 4608	4856	omsecor.exe	110
PID 4856 wrote to memory of 4608	4856	omsecor.exe	110
PID 4856 wrote to memory of 4608	4856	omsecor.exe	110
PID 4856 wrote to memory of 4608	4856	omsecor.exe	110
PID 4856 wrote to memory of 4608	4856	omsecor.exe	110
PID 4608 wrote to memory of 1368	4608	omsecor.exe	112
PID 4608 wrote to memory of 1368	4608	omsecor.exe	112
PID 4608 wrote to memory of 1368	4608	omsecor.exe	112
PID 1368 wrote to memory of 4168	1368	omsecor.exe	114
PID 1368 wrote to memory of 4168	1368	omsecor.exe	114
PID 1368 wrote to memory of 4168	1368	omsecor.exe	114
PID 1368 wrote to memory of 4168	1368	omsecor.exe	114
PID 1368 wrote to memory of 4168	1368	omsecor.exe	114

C:\Users\Admin\AppData\Local\Temp\3a1e84878623ec461fbbfe0b1f6352a0N.exe
"C:\Users\Admin\AppData\Local\Temp\3a1e84878623ec461fbbfe0b1f6352a0N.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\3a1e84878623ec461fbbfe0b1f6352a0N.exe
  C:\Users\Admin\AppData\Local\Temp\3a1e84878623ec461fbbfe0b1f6352a0N.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1436
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4856
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:4168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 224
        8⤵
        Program crash
        
        PID:3468
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 292
        6⤵
        Program crash
        
        PID:3964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 288
      4⤵
      Program crash
      PID:2432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 300
  2⤵
  - Program crash
  PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4832 -ip 4832
1⤵
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1376 -ip 1376
1⤵
PID:2840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4856 -ip 4856
1⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1368 -ip 1368
1⤵
PID:4224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 86dd565bfa8071ca5cee90169667763a1b7fec0adcad279b14da98f4f2e63c9e
MD5 d476c34e4686341f86ed4d9a566ff56f
SHA1 c9653ad3937ca9840fe8cbf9aeb744c45aa61aa7
SHA512 cee159838193f3048ee3097410d31e8aa0285dd622c957a20c886292daf896c927f69cbc82c9a951510a3b59a2ec4d54e0bea691f8f6df1e435a2c5c0c13bb30
SSDEEP 1536:RnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:RGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 938826733582d9fc3890813778947231a9ac24cdb92a22173d4833e0073a3354
MD5 70120f3b9dd98834937c5673d5ed2b75
SHA1 51b4a136888a6b17ffb3ebaa600c16138abed57c
SHA512 d7b861875839f2faa7a831a7bc72da1613348da6f6e5d02098c93a33f0503f2bdf130e2c42789987fe4791c49e0a252dfba1153feaa5ebb77895ec7ca616abd1
SSDEEP 1536:rnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:rGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 11ff75917b59937635211544d2556ae48b4cc5651dc5910b847fbac44be9efce
MD5 a611f2c7ba907c35961db9502ee41863
SHA1 36b56a688d1c9ab26bd347ad18c5e8a17c2f9f03
SHA512 23e8f877811d803f9e2f2ec1344d8653019f4db848d858babb475f39c2c8e4c48ebf980477a88bc1743aeeac2e1772e09c2e226ffda35c2a2bf875de48b0d75e
SSDEEP 1536:1nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:1Gs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1368-45-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1376-9-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1376-18-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1436-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1436-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1436-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1436-33-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1436-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1436-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1436-16-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1736-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1736-8-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1736-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1736-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4168-50-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4168-53-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4168-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4608-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4608-38-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4608-42-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4832-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4832-17-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4856-34-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4856-51-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads