neconyd | 00f6913a7d31ee2153efffdb263cd0d8f2ac8d6122ca87af9488954c16bf2b42

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 18:06

Target
00f6913a7d31ee2153efffdb263cd0d8f2ac8d6122ca87af9488954c16bf2b42.exe
Size 76KB
Sample240603-wp566aec9v
SHA256 00f6913a7d31ee2153efffdb263cd0d8f2ac8d6122ca87af9488954c16bf2b42
MD5 4ee79165224513a8c55a081f1ce8b3ac
SHA1 0b9c2c0b5457aeb1e77b77c83ff5187286848a60
SHA512 8128c9ad0d96b0296cf8a96d1385ed09015add43a1a99db3971714e95d6ad1973ef2986076a615772227377aa46ec896e2350331d55875f98332e6e2bef86d72
SSDEEP 768:gMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:gbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
4756	omsecor.exe
3144	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 4756	3776	00f6913a7d31ee2153efffdb263cd0d8f2ac8d6122ca87af9488954c16bf2b42.exe	90
PID 3776 wrote to memory of 4756	3776	00f6913a7d31ee2153efffdb263cd0d8f2ac8d6122ca87af9488954c16bf2b42.exe	90
PID 3776 wrote to memory of 4756	3776	00f6913a7d31ee2153efffdb263cd0d8f2ac8d6122ca87af9488954c16bf2b42.exe	90
PID 4756 wrote to memory of 3144	4756	omsecor.exe	108
PID 4756 wrote to memory of 3144	4756	omsecor.exe	108
PID 4756 wrote to memory of 3144	4756	omsecor.exe	108

C:\Users\Admin\AppData\Local\Temp\00f6913a7d31ee2153efffdb263cd0d8f2ac8d6122ca87af9488954c16bf2b42.exe
"C:\Users\Admin\AppData\Local\Temp\00f6913a7d31ee2153efffdb263cd0d8f2ac8d6122ca87af9488954c16bf2b42.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4292,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:8
1⤵
PID:2824

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 76KB
SHA256 24a7cd2302c7810640fc3a786f4f2bbf8ea0a9105bd222b3d808b9fb60e14826
MD5 8c61859c48040c7a3094c8df5f65c976
SHA1 3810faf0a850be88c7acc08be7da7967bcca9464
SHA512 bb2383b7de3afa3e4cdaae11ebc91fb35a941274869d0b0ef22be2f4e91c382774da1f637c7a766567ce625f8317b19c94452aabd33f92fc337827b74793ccf8
SSDEEP 768:DMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:DbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 76KB
SHA256 840fc61237ada34f88c851c656acd7b14e60f71b3d9341db7a0710384f7e625f
MD5 187217d02e3bb09cacfc5e4d6ed0ecd5
SHA1 a7a10246c1dd70ac6a98dfaea298616d7122e70c
SHA512 765be29ee138b3b3ea54ff24c623a817c8dda35a91f2139802ea91a805c169a7772ef618a6e404a855c1fe59badc1b8e660035367f420fa4d38e7f3a38025995
SSDEEP 768:UMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:UbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download