neconyd | e6eb956806d831e3392fe2179f61df2bb975abb70f71e0708d48b7d831e808e7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 17:38

Target
virussign.com_088f8298a89ec92102cbd30370edf540.exe
Size 88KB
Sample240528-v71tqaeg49
SHA256 e6eb956806d831e3392fe2179f61df2bb975abb70f71e0708d48b7d831e808e7
MD5 088f8298a89ec92102cbd30370edf540
SHA1 674d34498839da3bb7f07520d1195d66746019f8
SHA512 77175d6a7cf1c453d80c96e3eee4128ba5bca255b4028c477d9cf7773ff2d4b024d09dbcdb604404a95ff391f04c1402e298aaca5860182d5bcf3e4e6aa0e541
SSDEEP 1536:4d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:IdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
2884	omsecor.exe
3920	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 2884	1036	virussign.com_088f8298a89ec92102cbd30370edf540.exe	81
PID 1036 wrote to memory of 2884	1036	virussign.com_088f8298a89ec92102cbd30370edf540.exe	81
PID 1036 wrote to memory of 2884	1036	virussign.com_088f8298a89ec92102cbd30370edf540.exe	81
PID 2884 wrote to memory of 3920	2884	omsecor.exe	94
PID 2884 wrote to memory of 3920	2884	omsecor.exe	94
PID 2884 wrote to memory of 3920	2884	omsecor.exe	94

C:\Users\Admin\AppData\Local\Temp\virussign.com_088f8298a89ec92102cbd30370edf540.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_088f8298a89ec92102cbd30370edf540.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3920

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 a40c8265bde9821bcaac1303b3d2277912cd1452a321134e65aa7b489ed56c8b
MD5 6f13f5636f8480975bbd9cd7127a527e
SHA1 ad3fd75fbffcd22b213c7ca2d3889ca20de19b44
SHA512 001857c9dbd9bb96d7e4ba7a9e42a92de8348ca4006b15033ea6c949b7b28950cb4bfb6603a3817f3436fa44cac82d92d594b56b97dc790ef32e17eb7b62db43
SSDEEP 1536:sd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:UdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 da5454d5d5b3a8b93b24be3757ed56c9a43f35e5890f1f70ba79e225e090e938
MD5 5a0a333d100639abf945e21a9548e8be
SHA1 feeefd092f4c92d3a8266ab5327085ee08913d54
SHA512 dd2464b9bc42616b4c02c0e839f35c241f35b642a0bd5c58480c27d32ecbc68d531d5f3d9a5372d7814a02ab5c9b1bf83c034e629f7e25f3146a72dbaed7edb8
SSDEEP 1536:Td9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:TdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download