neconyd | 2d76d5ddf0ceff3364c6fe3e39972bf251401e45640b1153bebea14b3917c951

Analysis

max time kernel
126s
max time network
136s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06/05/2024, 23:53

Target

3528c59d43e7da38d5d09c44e15be5d0_NEAS.exe
Size

76KB
MD5

3528c59d43e7da38d5d09c44e15be5d0
SHA1

195073692dd2cf372fcdf7ecd4d8c8b186391a9e
SHA256

2d76d5ddf0ceff3364c6fe3e39972bf251401e45640b1153bebea14b3917c951
SHA512

a6db3d80621c539736b271cc8d422ba7e6c2a20c2fb88bc4147ab77156a583850a8c5cae58a3b9ab024d66d7c9ef32262451dccbd107a5fbf967d3f52065cfbe
SSDEEP

768:EMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:EbIvYvZEyFKF6N4yS+AQmZTl/5O

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Executes dropped EXE 3 IoCs

Loads dropped DLL 6 IoCs

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 3056	2836	3528c59d43e7da38d5d09c44e15be5d0_NEAS.exe	28
PID 2836 wrote to memory of 3056	2836	3528c59d43e7da38d5d09c44e15be5d0_NEAS.exe	28
PID 2836 wrote to memory of 3056	2836	3528c59d43e7da38d5d09c44e15be5d0_NEAS.exe	28
PID 2836 wrote to memory of 3056	2836	3528c59d43e7da38d5d09c44e15be5d0_NEAS.exe	28
PID 3056 wrote to memory of 1616	3056	omsecor.exe	32
PID 3056 wrote to memory of 1616	3056	omsecor.exe	32
PID 3056 wrote to memory of 1616	3056	omsecor.exe	32
PID 3056 wrote to memory of 1616	3056	omsecor.exe	32
PID 1616 wrote to memory of 1448	1616	omsecor.exe	33
PID 1616 wrote to memory of 1448	1616	omsecor.exe	33
PID 1616 wrote to memory of 1448	1616	omsecor.exe	33
PID 1616 wrote to memory of 1448	1616	omsecor.exe	33

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
6c0abe69d9650705d4fd8f355ec458b9

SHA1
b96fae3c723011683607d7e9913354b0208ce7fd

SHA256
efa9afbd59234f3bcff82839449883fb9e6e39a9f162dc9a44f484e104e94e1e

SHA512
15d42a0cd4368a95697e4405d5740ca47f809e65521289c8253ace255d70119c0ebd786a9eb3a8a187c3d6f5bf443ea5f45b6b7bc221281ed2ab8f5083d65874

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
916854cae460c79be4cdda041af1bd90

SHA1
1206d63abdb50a3cd9a32143ecb5385b1e0108dd

SHA256
dd84f6143ce8976958440e6b8d6c6ba5c58aab80d9b8c458b830a4930d8b081a

SHA512
b45023cbce9be9e6916058d96e4925dc7db139f2f04131a76f534f8d5368a9f530e00fcf76032c62835f1e7308c939cbad40fac312546dea91af8eb89f8c7ea5

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
76KB

MD5
05362b78c74bbb58ddfc866062bce4e3

SHA1
0d1c10bc7bafd548d0f31bab4099496890cdd62c

SHA256
27d5ab0dafe4fefd3ee99ce6d2ee3387c179649c2db3adda7ffe8961af545dfc

SHA512
70b20c65e2ddcf6bbe605c462295693b70105bbed571332078fb683d099c49426d56ba8571197c3351ff3b52226117add6e11c3609243610502387615dec7d2a

Download Submit