neconyd | 194c5d14f147eddc5548c8c5befbda756827fa7902bfc85cbbd1155cdd818bf6

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 19:10

Target

194c5d14f147eddc5548c8c5befbda756827fa7902bfc85cbbd1155cdd818bf6.exe
Size

62KB
MD5

38cb7110a28a34a1d1652a90d6713176
SHA1

81834b9835ab90ae9a2bd053ab068ba1ed11cace
SHA256

194c5d14f147eddc5548c8c5befbda756827fa7902bfc85cbbd1155cdd818bf6
SHA512

f9922ac58b964402915053930b5c4969ab3675a2db0db6eb4ae8a2e81603e573943a9fbd66d42727a087a0f3451eac42d28798fc4306fd2eb921d490f505fd09
SSDEEP

768:SMEIvFGvZEr8LFK0ic46N47eSdYAHwmZQp6JXXlaa5uA:SbIvYvZEyFKF6N4yS+AQmZtl/5

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Executes dropped EXE 3 IoCs

Loads dropped DLL 6 IoCs

pid	Process
2232	194c5d14f147eddc5548c8c5befbda756827fa7902bfc85cbbd1155cdd818bf6.exe
2232	194c5d14f147eddc5548c8c5befbda756827fa7902bfc85cbbd1155cdd818bf6.exe
2576	omsecor.exe
2576	omsecor.exe
2080	omsecor.exe
2080	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2576	2232	194c5d14f147eddc5548c8c5befbda756827fa7902bfc85cbbd1155cdd818bf6.exe	28
PID 2232 wrote to memory of 2576	2232	194c5d14f147eddc5548c8c5befbda756827fa7902bfc85cbbd1155cdd818bf6.exe	28
PID 2232 wrote to memory of 2576	2232	194c5d14f147eddc5548c8c5befbda756827fa7902bfc85cbbd1155cdd818bf6.exe	28
PID 2232 wrote to memory of 2576	2232	194c5d14f147eddc5548c8c5befbda756827fa7902bfc85cbbd1155cdd818bf6.exe	28
PID 2576 wrote to memory of 2080	2576	omsecor.exe	32
PID 2576 wrote to memory of 2080	2576	omsecor.exe	32
PID 2576 wrote to memory of 2080	2576	omsecor.exe	32
PID 2576 wrote to memory of 2080	2576	omsecor.exe	32
PID 2080 wrote to memory of 1628	2080	omsecor.exe	33
PID 2080 wrote to memory of 1628	2080	omsecor.exe	33
PID 2080 wrote to memory of 1628	2080	omsecor.exe	33
PID 2080 wrote to memory of 1628	2080	omsecor.exe	33

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
62KB

MD5
d15a9e7997f09e36e626c904d4c31656

SHA1
e49514871ada8c7c5c372b8277aac2a1f71517f9

SHA256
9527b04b0ced55e4e4c1ef6834355e3723afc5b2482e2f678c120e062099382c

SHA512
d7bc96676bf913de33aa13a9b167e7584a07e992a20d7d7ae10c0d0f8681ae0d08408c36846a5e32ccae3dfd778e8591d2e4b6535b255eb16084c81e8349db7b

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
62KB

MD5
b16a4071719f38434220953937459676

SHA1
226ff26db5b592585465c4ffbfae5237fb9f961c

SHA256
7ecf082bc8150e72b5372a7875664ee10ae702c802fedacef7e195fd1331b4ff

SHA512
6f6979bf4951e5cb604972d905a39d0bba78a3f28422530b8ea671164a5be6d209db54a5a875d41b7720d5236a24ae8fda0d9baea7bcda86b2da9475f6d9e2dc

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
62KB

MD5
7186ae32a8ce4f78fac8b7b40597c362

SHA1
cb3283fc2d70bc0764f5ebdaa88e33e0e08e31c6

SHA256
4e6d9538569bcc8d98a99a061219b77112622502596f0f3af67a793217c616bf

SHA512
b1beeaaeed99e0551a7b089be38a531e90dbcbbae8ae640bd5387094ec9024cb1c3b5f84181170c3e76cb16b93c494b3949ce8773c37c4710dcbcffd51738fd5

Download Submit