neconyd | f55998fed04ca7653c22add61065a9e36342b21097264c02cdff706573cf6238

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 04:49

Target
f55998fed04ca7653c22add61065a9e36342b21097264c02cdff706573cf6238.exe
Size 88KB
Sample240526-ff644agc56
SHA256 f55998fed04ca7653c22add61065a9e36342b21097264c02cdff706573cf6238
MD5 01450df7103b1b2dc19797a74a7d4b69
SHA1 7c2e62e49fe0ffbad2f5334c20a4825c4b1d43b7
SHA512 65f8396e59bc62cc0052bb37b64e211c4b02af0a0c473b88559209a02b67000c5cd9bdcc3628401921f96eb08e24de66b9b071a140616fb702ec7045dc446dd6
SSDEEP 768:WMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:WbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
2428	omsecor.exe
536	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 2428	4600	f55998fed04ca7653c22add61065a9e36342b21097264c02cdff706573cf6238.exe	83
PID 4600 wrote to memory of 2428	4600	f55998fed04ca7653c22add61065a9e36342b21097264c02cdff706573cf6238.exe	83
PID 4600 wrote to memory of 2428	4600	f55998fed04ca7653c22add61065a9e36342b21097264c02cdff706573cf6238.exe	83
PID 2428 wrote to memory of 536	2428	omsecor.exe	100
PID 2428 wrote to memory of 536	2428	omsecor.exe	100
PID 2428 wrote to memory of 536	2428	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\f55998fed04ca7653c22add61065a9e36342b21097264c02cdff706573cf6238.exe
"C:\Users\Admin\AppData\Local\Temp\f55998fed04ca7653c22add61065a9e36342b21097264c02cdff706573cf6238.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:536

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 a6774b080ae295a1426790be6f41d774214f3948ec6073ab115295fc74a6b940
MD5 0255c02ed300ac4e19ad4a82883a9fc2
SHA1 0ffd691d5a40e14347f92ea70e36d0e0ca8dc1f9
SHA512 f7b0b278cf2e2ec336d138808b5e87595b2fe3858c3649b394a9a3fa75e296e0ce6d5638c26ec3e6efd863a6e9f2e0a6680a9b65c69dd75ace3caf35e1cde8aa
SSDEEP 768:hMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:hbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 bc283b5ea833b92987ae1d0da1738d3289b8579f982ad7b277a396fd078f11a0
MD5 e656586527e8cbc00eeaf69358857e20
SHA1 7347c5bef81631dfe8e0351df5972b1d8dbf1914
SHA512 aba1633285edfbbf28743851900a8b782ef9ba596c37a32e62cbe070171388cea042ccb6c010091a79d29ce487c97698f9fd507a91570d1f7b2381b7560772bc
SSDEEP 768:zMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:zbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download