neconyd | ab73d1288f803793d9c482b044170aeec5c2a7b3491add1277aa3d8c8372fbea

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 01:22

Target
ab73d1288f803793d9c482b044170aeec5c2a7b3491add1277aa3d8c8372fbea.exe
Size 76KB
Sample240527-brq5sscb77
SHA256 ab73d1288f803793d9c482b044170aeec5c2a7b3491add1277aa3d8c8372fbea
MD5 665dba49dc0487d6d551af49f6a5ba91
SHA1 4736addf3072defc395fcb807358394bf9422210
SHA512 482750c672c1099fc8c9a053bf196eeec50003a849adee4279473904ebaeb9be5cdb6c8042d9f41aad796bd46899d655f9a0c3cb9e2d439608b1810ddf6ddc5c
SSDEEP 768:VMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:VbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
4552	omsecor.exe
5104	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4552	4644	ab73d1288f803793d9c482b044170aeec5c2a7b3491add1277aa3d8c8372fbea.exe	84
PID 4644 wrote to memory of 4552	4644	ab73d1288f803793d9c482b044170aeec5c2a7b3491add1277aa3d8c8372fbea.exe	84
PID 4644 wrote to memory of 4552	4644	ab73d1288f803793d9c482b044170aeec5c2a7b3491add1277aa3d8c8372fbea.exe	84
PID 4552 wrote to memory of 5104	4552	omsecor.exe	105
PID 4552 wrote to memory of 5104	4552	omsecor.exe	105
PID 4552 wrote to memory of 5104	4552	omsecor.exe	105

C:\Users\Admin\AppData\Local\Temp\ab73d1288f803793d9c482b044170aeec5c2a7b3491add1277aa3d8c8372fbea.exe
"C:\Users\Admin\AppData\Local\Temp\ab73d1288f803793d9c482b044170aeec5c2a7b3491add1277aa3d8c8372fbea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:5104

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 e2c074171f43c7a2a160fb9613513dabdd2ae9a6996f3ef81ad8b690b9d77018
MD5 97550c9d2ea26826bff4bb73c3fcd01c
SHA1 46cfb8b0b0876ab63ca4b38465b6aac30cdc9a6f
SHA512 fa2413b43f02d2d46b2bfac06047cf55b16de2d100514e9beb82bb639485a6b495464e70a71134d9e180c1fcc0888488acde4beece6f26ba4ff10ca6d389f108
SSDEEP 768:tMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:tbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 77a939fcf4ade82df4877cd57749afe3823ed09f2d94c49c134578c468d06727
MD5 6b0b59594e72f94907bde6c43d199a1e
SHA1 6c37edddbcea6acd4cc29a6458c4b85b31ed7af5
SHA512 ae50b7e0082566aa06046565d94d4f6f841db46554aa6bd3a0060452c3d7ffba6f84d30e4a7ac1e203af70abae16e9cac52aacb0b9f93baae0d3f44daa7c38c3
SSDEEP 768:PMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:PbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download