neconyd | 27eae736c4c505a31514b44c5c8c996a6784e9fa350d14c624dd6a62718f0e25

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 20:16

Target

27eae736c4c505a31514b44c5c8c996a6784e9fa350d14c624dd6a62718f0e25.exe
Size

84KB
MD5

85210efde087f655b57ad323483b7c10
SHA1

3dbc2069201d5bd73b057c4637e6d86ccdafae53
SHA256

27eae736c4c505a31514b44c5c8c996a6784e9fa350d14c624dd6a62718f0e25
SHA512

5dafc27d33436548cdd54cc74771573214cbc3af72bf2de60e27400eaf11b83719c11688754fe083d4df8dadc271f0266e1eb0cd3d182046337966063b467cee
SSDEEP

768:QMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:QbIvYvZEyFKF6N4yS+AQmZTl/5

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Executes dropped EXE 2 IoCs

pid	Process
3220	omsecor.exe
2948	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 3220	2664	27eae736c4c505a31514b44c5c8c996a6784e9fa350d14c624dd6a62718f0e25.exe	81
PID 2664 wrote to memory of 3220	2664	27eae736c4c505a31514b44c5c8c996a6784e9fa350d14c624dd6a62718f0e25.exe	81
PID 2664 wrote to memory of 3220	2664	27eae736c4c505a31514b44c5c8c996a6784e9fa350d14c624dd6a62718f0e25.exe	81
PID 3220 wrote to memory of 2948	3220	omsecor.exe	90
PID 3220 wrote to memory of 2948	3220	omsecor.exe	90
PID 3220 wrote to memory of 2948	3220	omsecor.exe	90

C:\Users\Admin\AppData\Local\Temp\27eae736c4c505a31514b44c5c8c996a6784e9fa350d14c624dd6a62718f0e25.exe
"C:\Users\Admin\AppData\Local\Temp\27eae736c4c505a31514b44c5c8c996a6784e9fa350d14c624dd6a62718f0e25.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:2948

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
84KB

MD5
8cc1a33b41283378f86660aed4bc9a27

SHA1
30a998966e39ccc62e5ac3b42bcdd3f4cb7f294f

SHA256
ed25271180febea41114912052de266e85702e72d54e0fd55fab2e0c186c70de

SHA512
42200c672c25792ae9550de22cb05be16257a0f062a696b8571378737333c67519703d068c50ae2b95ae22f143030539abcd46f19672597b3a019917b6f194a2

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
84KB

MD5
0ee418880284e4ada25b9ff4b73a1957

SHA1
93b3f70b954cca14fe7fcbeabf8c412b737161b4

SHA256
4668539c0812f555941e117f9ab445621960436d573af21a796499d51fbb1b40

SHA512
853f38bb2496502356c7e75e263e2dfdb747f71e75d357de31d0984dcb551cac10841d33bf899c59fc6f725f1b96bb0a9dc577d0d9986efd463a991f511999c5

Download Submit