neconyd | 864b9db2eff7cbd50ed6bd5b36fcb87da7b16055ee3c1753c206c1cf84a0fabe

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ecb9d431cda95233761c66423b1ef980N.exe
Size 134KB
Sample240721-vbtersxfnj
SHA256 864b9db2eff7cbd50ed6bd5b36fcb87da7b16055ee3c1753c206c1cf84a0fabe
MD5 ecb9d431cda95233761c66423b1ef980
SHA1 b5acbff25e6ae6241564b3bee6376191a6bb4fdc
SHA512 f223ae7fa83582c48638f30d4abecf1669d13b5651ab61bb96d2753979ddf20f3b9e93a4e76b1736e33476743998c47d06c557af75997c26d9950f560abaaab9
SSDEEP 1536:4DfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:eiRTeH0NqAW6J6f1tqF6dngNmaZC7M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
2452	omsecor.exe
2372	omsecor.exe
4500	omsecor.exe
2060	omsecor.exe
2084	omsecor.exe
4308	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5088 set thread context of 4504	5088	ecb9d431cda95233761c66423b1ef980N.exe	84
PID 2452 set thread context of 2372	2452	omsecor.exe	88
PID 4500 set thread context of 2060	4500	omsecor.exe	114
PID 2084 set thread context of 4308	2084	omsecor.exe	118

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2804	5088	WerFault.exe	83
4848	2452	WerFault.exe	86
3160	4500	WerFault.exe	113
2168	2084	WerFault.exe	116

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4504	5088	ecb9d431cda95233761c66423b1ef980N.exe	84
PID 5088 wrote to memory of 4504	5088	ecb9d431cda95233761c66423b1ef980N.exe	84
PID 5088 wrote to memory of 4504	5088	ecb9d431cda95233761c66423b1ef980N.exe	84
PID 5088 wrote to memory of 4504	5088	ecb9d431cda95233761c66423b1ef980N.exe	84
PID 5088 wrote to memory of 4504	5088	ecb9d431cda95233761c66423b1ef980N.exe	84
PID 4504 wrote to memory of 2452	4504	ecb9d431cda95233761c66423b1ef980N.exe	86
PID 4504 wrote to memory of 2452	4504	ecb9d431cda95233761c66423b1ef980N.exe	86
PID 4504 wrote to memory of 2452	4504	ecb9d431cda95233761c66423b1ef980N.exe	86
PID 2452 wrote to memory of 2372	2452	omsecor.exe	88
PID 2452 wrote to memory of 2372	2452	omsecor.exe	88
PID 2452 wrote to memory of 2372	2452	omsecor.exe	88
PID 2452 wrote to memory of 2372	2452	omsecor.exe	88
PID 2452 wrote to memory of 2372	2452	omsecor.exe	88
PID 2372 wrote to memory of 4500	2372	omsecor.exe	113
PID 2372 wrote to memory of 4500	2372	omsecor.exe	113
PID 2372 wrote to memory of 4500	2372	omsecor.exe	113
PID 4500 wrote to memory of 2060	4500	omsecor.exe	114
PID 4500 wrote to memory of 2060	4500	omsecor.exe	114
PID 4500 wrote to memory of 2060	4500	omsecor.exe	114
PID 4500 wrote to memory of 2060	4500	omsecor.exe	114
PID 4500 wrote to memory of 2060	4500	omsecor.exe	114
PID 2060 wrote to memory of 2084	2060	omsecor.exe	116
PID 2060 wrote to memory of 2084	2060	omsecor.exe	116
PID 2060 wrote to memory of 2084	2060	omsecor.exe	116
PID 2084 wrote to memory of 4308	2084	omsecor.exe	118
PID 2084 wrote to memory of 4308	2084	omsecor.exe	118
PID 2084 wrote to memory of 4308	2084	omsecor.exe	118
PID 2084 wrote to memory of 4308	2084	omsecor.exe	118
PID 2084 wrote to memory of 4308	2084	omsecor.exe	118

C:\Users\Admin\AppData\Local\Temp\ecb9d431cda95233761c66423b1ef980N.exe
"C:\Users\Admin\AppData\Local\Temp\ecb9d431cda95233761c66423b1ef980N.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\ecb9d431cda95233761c66423b1ef980N.exe
  C:\Users\Admin\AppData\Local\Temp\ecb9d431cda95233761c66423b1ef980N.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2372
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4500
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:4308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 256
        8⤵
        Program crash
        
        PID:2168
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 292
        6⤵
        Program crash
        
        PID:3160
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 288
      4⤵
      Program crash
      PID:4848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 288
  2⤵
  - Program crash
  PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5088 -ip 5088
1⤵
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2452 -ip 2452
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4500 -ip 4500
1⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2084 -ip 2084
1⤵
PID:976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 3406000dd174b4d4279773062e3d432c7e592b1d32b22587ef6a0b298df47108
MD5 ab95c896f08226b050ec35e1f659d281
SHA1 32d7d667fb31b1aac6bd2228991ad9c1585b2c60
SHA512 eff036a7bc0f7ffbf15d5c9da355fd5e3da77458080cf69c7748818c48be82ed6e21bdd047cf1c435080f105bb31e13cdf5aa72aadc361f8cc2dcc41d9aa3a11
SSDEEP 1536:eDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:AiRTeH0NqAW6J6f1tqF6dngNmaZC7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 d75213b1fe18a6da3b92ed59520b09fd9660091beabe8279e6b0795fbadac941
MD5 c1d6c7189a69580fa3bc6559b49eea3e
SHA1 39a7a34b4018af998b93029a54f6518165f584e3
SHA512 1f1152737b30c76bd19c0561c652e3a30e5a2bb925816078dc3526a3df646986e707cc9bcb2c044bf1c59c86c3ff9d2c1ea047ab4ac023e838e11bff58a1c07a
SSDEEP 1536:UDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:qiRTeH0NqAW6J6f1tqF6dngNmaZC7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 134KB
SHA256 f5d036e3a358cfa1057beecc5b8cd7e526d5831842a4f01316617a26679260a6
MD5 70431f67d97097250ea75f6aeb1fa9e4
SHA1 3577ea3d4610f4e6983feb56d263eed599ea59a2
SHA512 1ffb1483ac492e15c69b312258e22935cb7cbd4fff670f659a1b03ed37133459f83ff4a5afa430ae630d80e9425919ba02bc4edb084555fbf28fd44c12378fcd
SSDEEP 1536:GDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:4iRTeH0NqAW6J6f1tqF6dngNmaZC7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2060-35-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2060-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2060-34-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2084-50-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2084-41-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2372-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2372-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2372-17-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2372-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2372-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2372-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2372-28-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2452-11-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4308-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4308-46-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4308-51-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4500-31-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4500-49-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4504-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4504-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4504-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4504-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5088-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5088-16-0x0000000000400000-0x0000000000424000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads