neconyd | a434e16be4cc502f155c913e4254429a49d30adf6c1a095da12f343e810bd6c1

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 00:42

Target
a434e16be4cc502f155c913e4254429a49d30adf6c1a095da12f343e810bd6c1.exe
Size 80KB
Sample240519-a2mdxshc66
SHA256 a434e16be4cc502f155c913e4254429a49d30adf6c1a095da12f343e810bd6c1
MD5 cb3434969f4bad85b1e4c0db71c29cda
SHA1 970f8c0da25cbbcb5e30439502782cc62f0f4ca2
SHA512 92fe71872fb7bf121f9728c32c42a88c69436a4d16458783587e37fb7118ccad846b1be65de2ee803aa4e04e59ffb52671cefc00aacf70573ced2757d92cb442
SSDEEP 768:AfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:AfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
1708	omsecor.exe
1400	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 1708	4928	a434e16be4cc502f155c913e4254429a49d30adf6c1a095da12f343e810bd6c1.exe	83
PID 4928 wrote to memory of 1708	4928	a434e16be4cc502f155c913e4254429a49d30adf6c1a095da12f343e810bd6c1.exe	83
PID 4928 wrote to memory of 1708	4928	a434e16be4cc502f155c913e4254429a49d30adf6c1a095da12f343e810bd6c1.exe	83
PID 1708 wrote to memory of 1400	1708	omsecor.exe	99
PID 1708 wrote to memory of 1400	1708	omsecor.exe	99
PID 1708 wrote to memory of 1400	1708	omsecor.exe	99

C:\Users\Admin\AppData\Local\Temp\a434e16be4cc502f155c913e4254429a49d30adf6c1a095da12f343e810bd6c1.exe
"C:\Users\Admin\AppData\Local\Temp\a434e16be4cc502f155c913e4254429a49d30adf6c1a095da12f343e810bd6c1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:1400

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 80KB
SHA256 f03462a54ae34531717e8030b0885a70975d832a78d6d4e72115fe3cf5bc2efe
MD5 e184c4c8c8c6829b6ff0c9b388fad86a
SHA1 96d33983a51c2a052b80288be741b41a728c7442
SHA512 e83857fc4b3043d05e9bcedbf0dacaa3ee369f9a15b170735dd8ad2f59b5a024042f9b8c7619da2448040e56305d63b0bdb3fbf23d31670e37abf0f95aab48b9
SSDEEP 768:cfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:cfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 80KB
SHA256 329bc1711d82eedbaa74c4bb0da7b46d3028eeba814eb38de15b45a86372a6e0
MD5 915cfd832bea147b36cf92f1cc6e5b72
SHA1 df444383a8bebca883ebb5c31ed9a296b90de1c9
SHA512 71cd3b6a6fbecd60ece56c77147124b6af0fcf2b48cc65b7d6e80a84951f73a8f89006add1b29cac379b2532a66bc2bfb732ae875e11cb4aaa2ff317dbe9715f
SSDEEP 768:6fMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:6fbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download