neconyd | e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 04:08

Target
e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787.exe
Size 88KB
Sample240530-eqpgcsea2x
SHA256 e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787
MD5 37819cbdcd4262853dd67db9211e605f
SHA1 94e2797ddc43704c9b666020786b29e96f4eed69
SHA512 9c7ce92910a6baa9cfab90dc64f716041f30c70a696ce134a7855eb2e3b64db349e36e761f423540625cb762908aee62be8ca0c35678d2fa92f19e26c70b1123
SSDEEP 1536:Id9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:4dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
1076	omsecor.exe
1568	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 1076	1396	e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787.exe	83
PID 1396 wrote to memory of 1076	1396	e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787.exe	83
PID 1396 wrote to memory of 1076	1396	e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787.exe	83
PID 1076 wrote to memory of 1568	1076	omsecor.exe	100
PID 1076 wrote to memory of 1568	1076	omsecor.exe	100
PID 1076 wrote to memory of 1568	1076	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787.exe
"C:\Users\Admin\AppData\Local\Temp\e13dd48aafb3a93ce59d0947a7e62c9b50c68abe500e54bc4a56c8b595d67787.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:1568

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 b2528a52232f685733cbddd09509437315c9f96d9bbdc9a3bb97e9c9d3b089cc
MD5 558068460ab3b0e39cdf41fdd1dc7171
SHA1 7a89967207f9f1f7265d49c75c0c9fb663478848
SHA512 e6137655d030c55076f2a4dd67e3381e66677fe99c643a8cc7c78533b9e0ecf2b7d6212d6a4b0cc0b6b1989809bf8e9a8a53aa6dd4de766ff2337538ff2f948e
SSDEEP 1536:sd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:UdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 0c89022d471d30d339b0cb8f2e3faf8d8545f9b3b168546df67562955664cf17
MD5 5190808f7d3b7c51cde8798075b6d56b
SHA1 b2f38f7a1ed3b211968729264a41a7a5e8020175
SHA512 81a34aed28d68b31e9a390b58e140114f15ba693355ebbcea097bf6e9adf94a943ad06c0b521e1e8dcfe84a2b1891eda6872ab6c41ec3e06d7a1aa6d4b2bb8e5
SSDEEP 1536:Ed9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:8dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download