neconyd | 2c535b5b8e242717c64f8d1c6f39903829fb87ac086749b0ed044ba7d2e5c4fc

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 18:04

Target
2c535b5b8e242717c64f8d1c6f39903829fb87ac086749b0ed044ba7d2e5c4fc.exe
Size 84KB
Sample240522-wn3dwabc2s
SHA256 2c535b5b8e242717c64f8d1c6f39903829fb87ac086749b0ed044ba7d2e5c4fc
MD5 0440f8fc9171a50160a8a9e0279fe4b0
SHA1 3c0ae07a71566b07db6a3037e8ff7275b9f827f8
SHA512 61fa3937213988dc99a3aa1b1b30ffbb081a04ee963df6907e8e701e41d36f1c168c2a6c84f370fcd3a5193edaa55474db9693aa07e4915bf7807918bb5f22f0
SSDEEP 1536:Td9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:TdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
2876	omsecor.exe
3104	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 2876	5112	2c535b5b8e242717c64f8d1c6f39903829fb87ac086749b0ed044ba7d2e5c4fc.exe	90
PID 5112 wrote to memory of 2876	5112	2c535b5b8e242717c64f8d1c6f39903829fb87ac086749b0ed044ba7d2e5c4fc.exe	90
PID 5112 wrote to memory of 2876	5112	2c535b5b8e242717c64f8d1c6f39903829fb87ac086749b0ed044ba7d2e5c4fc.exe	90
PID 2876 wrote to memory of 3104	2876	omsecor.exe	100
PID 2876 wrote to memory of 3104	2876	omsecor.exe	100
PID 2876 wrote to memory of 3104	2876	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\2c535b5b8e242717c64f8d1c6f39903829fb87ac086749b0ed044ba7d2e5c4fc.exe
"C:\Users\Admin\AppData\Local\Temp\2c535b5b8e242717c64f8d1c6f39903829fb87ac086749b0ed044ba7d2e5c4fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:3416

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 ff4d1339f4d57b667cfcb22d5beb40359040cf6c93d3aea49e3cf28f66e9fa3b
MD5 789ad43d132970e75072f253d64cdb36
SHA1 751ff2ab4d73974572d51801a61f850e87fac667
SHA512 7fd2db8619ff7c68b91486e6659f1af8c2630836dcaa128abc62537b7c1973a96138e1bcbe9a4fbed3258ae243a0e555054682f486153cce7de5580e17078c47
SSDEEP 1536:bd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:rdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 5a009e80f2f94c658dc0a4e073ba8461fa32cd00f07093fe4065d544d91769a7
MD5 b8154daad4c01a9f84bcc6caf7160195
SHA1 def3e30690fd0d20043c3a787ba66970a2607b9d
SHA512 cff7abac90a6ffc175205a0c624963b03b5ecd0b1fab1a01a78ed5dd5e190ae3cf9b8d1247122995b8cb90da31d6b4e9885e5db93e6772ece009acd54d217a7f
SSDEEP 1536:yd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:CdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download