neconyd | 49b8eae60114e84b870338851728ca209f9a91ab0ce39cfd1e73d5423e24735a

Analysis

max time kernel
114s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 06:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7622e14cb2edde31a00205cead8c7f30N.exe
Size 71KB
Sample240722-hp67katfrj
SHA256 49b8eae60114e84b870338851728ca209f9a91ab0ce39cfd1e73d5423e24735a
MD5 7622e14cb2edde31a00205cead8c7f30
SHA1 874b3811e50c0e9fded066dde74b90a441080b91
SHA512 44e98857f58fe66a7dab0aca3694ecd8611f84ca86d6459697af31be08e8cdbb5a274ea53cda54e0a78b9651dc6cd2ff8b25c013c909ce2915d97d6dca250f1b
SSDEEP 1536:3d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:/dseIOMEZEyFjEOFqTiQmQDHIbH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1112	omsecor.exe
3952	omsecor.exe
4796	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1112	1544	7622e14cb2edde31a00205cead8c7f30N.exe	84
PID 1544 wrote to memory of 1112	1544	7622e14cb2edde31a00205cead8c7f30N.exe	84
PID 1544 wrote to memory of 1112	1544	7622e14cb2edde31a00205cead8c7f30N.exe	84
PID 1112 wrote to memory of 3952	1112	omsecor.exe	100
PID 1112 wrote to memory of 3952	1112	omsecor.exe	100
PID 1112 wrote to memory of 3952	1112	omsecor.exe	100
PID 3952 wrote to memory of 4796	3952	omsecor.exe	101
PID 3952 wrote to memory of 4796	3952	omsecor.exe	101
PID 3952 wrote to memory of 4796	3952	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\7622e14cb2edde31a00205cead8c7f30N.exe
"C:\Users\Admin\AppData\Local\Temp\7622e14cb2edde31a00205cead8c7f30N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      PID:4796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 71KB
SHA256 65a4423959f0cede44303c47db8deb786972f9a29e4d521bbd889aca2816da96
MD5 26bd35b259f377526199470960725f11
SHA1 47273388624e020a99d73d7221b97e5f83d10494
SHA512 cab3d9516163107800f277b43c2ef34fcd7e6d93e562922673a9dcea11b6501bcc0145360c64e5672ff8d44e046c5d0b735fbdf9bf8c03ff617206f8da64ec3c
SSDEEP 1536:/d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:3dseIOMEZEyFjEOFqTiQmQDHIbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 71KB
SHA256 48eff4039ee9f845f024002f06830c578e8a3dd44421bc5b50533a424aa1d7ea
MD5 4a476949308b0c22637f9206b68827aa
SHA1 340dfec6f33bc793c8f7d69b5c5275052afbd4b3
SHA512 a556ffac0a64a207e7b58841edb07d4dd50baf091bef7b1807e39194edcfdc32adc4f995f9a1532ecd28828223901fdf3442cea90fd4b0cd403f43887fa0f922
SSDEEP 1536:Dd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:jdseIOMEZEyFjEOFqTiQmQDHIbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 71KB
SHA256 a57905e5d2ba46e0c6157653dbfec358fd94c52851b6e882f6e79ed70478a73a
MD5 5c8e2c9aa01cc8f9c4f9cc4d4f69662e
SHA1 a8fc5dad8976cafa3a125b6341afdd56169e79b5
SHA512 e529020d7a5d8d8e91ba702ea8def1d6b908c9df3e8266c5bd24cdd57cfb685adb9a1c620bf768d3b2ea629f0ed5e0a45ed7e52ae364feca813af78e45f04758
SSDEEP 1536:7d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:LdseIOMEZEyFjEOFqTiQmQDHIbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1112-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1112-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1112-12-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1544-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1544-5-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3952-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3952-18-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4796-19-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4796-20-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads