neconyd | aacba87c797114667a9c2e19aa87e3e95334e09009d4a8cc115e7410d208dd7e

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 01:29

Target
aacba87c797114667a9c2e19aa87e3e95334e09009d4a8cc115e7410d208dd7e.exe
Size 84KB
Sample240530-bwf6dshe9v
SHA256 aacba87c797114667a9c2e19aa87e3e95334e09009d4a8cc115e7410d208dd7e
MD5 9c1227561ce4995fba946ff54c56d417
SHA1 637d93112c3c72f3a6fa597969fe9ad5f9b1c7fb
SHA512 ea4474ec866e61d291c1436263dffda6cb626abdf5e8307312b43e25ffe580f5714bf1bb9a836b7b77f5d1b2523364bec30d5f2059bc7b50e5979a3f02467ca9
SSDEEP 1536:Dd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:jdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
1632	omsecor.exe
4480	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 1632	3580	aacba87c797114667a9c2e19aa87e3e95334e09009d4a8cc115e7410d208dd7e.exe	92
PID 3580 wrote to memory of 1632	3580	aacba87c797114667a9c2e19aa87e3e95334e09009d4a8cc115e7410d208dd7e.exe	92
PID 3580 wrote to memory of 1632	3580	aacba87c797114667a9c2e19aa87e3e95334e09009d4a8cc115e7410d208dd7e.exe	92
PID 1632 wrote to memory of 4480	1632	omsecor.exe	102
PID 1632 wrote to memory of 4480	1632	omsecor.exe	102
PID 1632 wrote to memory of 4480	1632	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\aacba87c797114667a9c2e19aa87e3e95334e09009d4a8cc115e7410d208dd7e.exe
"C:\Users\Admin\AppData\Local\Temp\aacba87c797114667a9c2e19aa87e3e95334e09009d4a8cc115e7410d208dd7e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:2772

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 bcc5d5fc922b1204cf5d00a116e36cd16858e46985671ae5606d18c5f4517b37
MD5 fb94e4d040bea939ad7ed0eb4fc9963a
SHA1 c24273344e6ea67d09e0b1bab579f5b6c46c9f3f
SHA512 dbc19d4ad4f021bceb78330dcb147434b2d489a0e594f80cfb354302d0f9b2ea60aafd5aa738ea5c7e6db7e7fbff515ab10cad915511efcc5a08d814b55a3e87
SSDEEP 1536:jd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:DdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 a115f6abc41697624e80108dde292ebfa59aaf282b1e3ede128ea4c5bbe605da
MD5 8cb4f0a20aac19ecd3f74e0000348dd2
SHA1 9105757e70f43948bd63e6514e5cffc47e15790f
SHA512 8930ee831c1bc7529341c9ce1d823a0b639e105af89b80945fefcda1ce3efab2413118dc22efdaf7ba2536b00bb57360337f101110153d5769f65b9d167723de
SSDEEP 1536:Dd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:jdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download