neconyd | 27eae736c4c505a31514b44c5c8c996a6784e9fa350d14c624dd6a62718f0e25

Analysis

max time kernel
146s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 20:16

Target

27eae736c4c505a31514b44c5c8c996a6784e9fa350d14c624dd6a62718f0e25.exe
Size

84KB
MD5

85210efde087f655b57ad323483b7c10
SHA1

3dbc2069201d5bd73b057c4637e6d86ccdafae53
SHA256

27eae736c4c505a31514b44c5c8c996a6784e9fa350d14c624dd6a62718f0e25
SHA512

5dafc27d33436548cdd54cc74771573214cbc3af72bf2de60e27400eaf11b83719c11688754fe083d4df8dadc271f0266e1eb0cd3d182046337966063b467cee
SSDEEP

768:QMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:QbIvYvZEyFKF6N4yS+AQmZTl/5

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Executes dropped EXE 3 IoCs

Loads dropped DLL 6 IoCs

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2172	1400	27eae736c4c505a31514b44c5c8c996a6784e9fa350d14c624dd6a62718f0e25.exe	28
PID 1400 wrote to memory of 2172	1400	27eae736c4c505a31514b44c5c8c996a6784e9fa350d14c624dd6a62718f0e25.exe	28
PID 1400 wrote to memory of 2172	1400	27eae736c4c505a31514b44c5c8c996a6784e9fa350d14c624dd6a62718f0e25.exe	28
PID 1400 wrote to memory of 2172	1400	27eae736c4c505a31514b44c5c8c996a6784e9fa350d14c624dd6a62718f0e25.exe	28
PID 2172 wrote to memory of 2684	2172	omsecor.exe	32
PID 2172 wrote to memory of 2684	2172	omsecor.exe	32
PID 2172 wrote to memory of 2684	2172	omsecor.exe	32
PID 2172 wrote to memory of 2684	2172	omsecor.exe	32
PID 2684 wrote to memory of 2820	2684	omsecor.exe	33
PID 2684 wrote to memory of 2820	2684	omsecor.exe	33
PID 2684 wrote to memory of 2820	2684	omsecor.exe	33
PID 2684 wrote to memory of 2820	2684	omsecor.exe	33

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
84KB

MD5
8cc1a33b41283378f86660aed4bc9a27

SHA1
30a998966e39ccc62e5ac3b42bcdd3f4cb7f294f

SHA256
ed25271180febea41114912052de266e85702e72d54e0fd55fab2e0c186c70de

SHA512
42200c672c25792ae9550de22cb05be16257a0f062a696b8571378737333c67519703d068c50ae2b95ae22f143030539abcd46f19672597b3a019917b6f194a2

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
84KB

MD5
a710df2222800ecfcf363e7ae955c36e

SHA1
a1b070cf3c2754ac6c4c35fe15e7012c54084233

SHA256
c0e22e9f4e87eb6b8ba0a6bae88c91743bcbbcbc5433dd55e4f1bda007ed7792

SHA512
0a14ee272c6b6d0c908c19d5d8a7b32404e0e0cd7454c2c4be9d0c46a2ef96c485b1dcc0ae349b6ed7211f8a49f87bf308837ab02da9acbba0b1e56b7e9dbe72

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
84KB

MD5
259fb6ffe09eda3b6692aea43bb814b6

SHA1
4a2c4d03983bafbc0bb7725fc5a000b682f837f0

SHA256
ef283f060c757c638be83168b2309f53dda5aa46c54754a0a1ae1bd789e2fc54

SHA512
594850f24f1307983073f7514d9e3183486a2f6614f0be96e51028647b7aa7e2e5397e8097a70b333320ca7beb8d0106c458f8e603c0c9ba9799b9c7148f6227

Download Submit