neconyd | 52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 21:43

Target

52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1.exe
Size

72KB
MD5

494272cda145356436ad683657c83908
SHA1

59bbd25db1bf0c0ee790905254b46ef642285adf
SHA256

52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1
SHA512

bbb993eeb9dd60737d46e0bbfd7ab804194888ca301e02606304aae7e01624701b5a3006ad1d660b438c8966db66e8984e9d4ae287ac8b9d3a2564c6eceade9f
SSDEEP

1536:5d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:ZdseIOMEZEyFjEOFqTiQm5l/5211

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Executes dropped EXE 3 IoCs

Loads dropped DLL 6 IoCs

pid	Process
1940	52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1.exe
1940	52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1.exe
2064	omsecor.exe
2064	omsecor.exe
2804	omsecor.exe
2804	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2064	1940	52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1.exe	28
PID 1940 wrote to memory of 2064	1940	52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1.exe	28
PID 1940 wrote to memory of 2064	1940	52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1.exe	28
PID 1940 wrote to memory of 2064	1940	52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1.exe	28
PID 2064 wrote to memory of 2804	2064	omsecor.exe	32
PID 2064 wrote to memory of 2804	2064	omsecor.exe	32
PID 2064 wrote to memory of 2804	2064	omsecor.exe	32
PID 2064 wrote to memory of 2804	2064	omsecor.exe	32
PID 2804 wrote to memory of 2824	2804	omsecor.exe	33
PID 2804 wrote to memory of 2824	2804	omsecor.exe	33
PID 2804 wrote to memory of 2824	2804	omsecor.exe	33
PID 2804 wrote to memory of 2824	2804	omsecor.exe	33

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
73ba94eac2bf65978b142ed2e57d3f39

SHA1
42e1018b8c3c3b6c56e7558949e9f2c29fe700e0

SHA256
678cdf90519de4b857dcee3116828def3100591c8f47bbdc839d029a3a0b10c4

SHA512
85aa213949426373f9d8eb4a0574ddd94cffb70d2cd2c79214f389db325995052d07e211dac3967ecfd5f42a492f2c7174389997fb1934606c72e86444b3b3aa

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
6357c338150c09fc71642f8c18d0ad59

SHA1
29c054846b593bc2cd7ae68815fe029a2bb02d24

SHA256
1e58fb221b40865af362433d52734197500d1d01761cffd5a3d8f8d05f1a7851

SHA512
8047c39ca9ab973ec821ea7666f6d50e05bd0b990ea00b6f709673156b00c5f43057aa38071c87cc2fa5242c3cef6b94a832043dd600a4bb7997def6c31bd18e

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
72KB

MD5
da43c049f54e60991543230c1aaa6132

SHA1
572688e5bfddf4c80f9ee7113088b194b4085cc0

SHA256
c1ac3040c342743bd21490ac747e1ad8dae3ade048dee5ea0bbb2f53b3909884

SHA512
1883985e3dc006a6ea919b258bef65acf6c91af8b7dbabb6a6e766fd2641ba55675afa668777501658a637f5536271933fef57f7ac97520147f90f0d10460e7b

Download Submit