neconyd | aadc5ebf5aeb828fd9f4a3a2a5cbe9707f48ec8f3b7eb4cf654dfb7bb6ba7f99

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 01:36

Target
aadc5ebf5aeb828fd9f4a3a2a5cbe9707f48ec8f3b7eb4cf654dfb7bb6ba7f99.exe
Size 61KB
Sample240605-b1ne9sbb68
SHA256 aadc5ebf5aeb828fd9f4a3a2a5cbe9707f48ec8f3b7eb4cf654dfb7bb6ba7f99
MD5 e4c1468f3d4d5d71a8abcdc9b3cdba0e
SHA1 61df20b9182689a2cef0b3a159375721ea6bbbf8
SHA512 cd9ac5a14a23629146212ddeabf8e0f6f1d3fba384cc0a4a06436fd3d91f87550f44069ae2b04a48bff658cc573b8416be40739e1a3b8d8a076879a6115f61d6
SSDEEP 1536:4d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZlLl/5:IdseIOMEZEyFjEOFqTiQm7l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
5048	omsecor.exe
880	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 5048	772	aadc5ebf5aeb828fd9f4a3a2a5cbe9707f48ec8f3b7eb4cf654dfb7bb6ba7f99.exe	91
PID 772 wrote to memory of 5048	772	aadc5ebf5aeb828fd9f4a3a2a5cbe9707f48ec8f3b7eb4cf654dfb7bb6ba7f99.exe	91
PID 772 wrote to memory of 5048	772	aadc5ebf5aeb828fd9f4a3a2a5cbe9707f48ec8f3b7eb4cf654dfb7bb6ba7f99.exe	91
PID 5048 wrote to memory of 880	5048	omsecor.exe	101
PID 5048 wrote to memory of 880	5048	omsecor.exe	101
PID 5048 wrote to memory of 880	5048	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\aadc5ebf5aeb828fd9f4a3a2a5cbe9707f48ec8f3b7eb4cf654dfb7bb6ba7f99.exe
"C:\Users\Admin\AppData\Local\Temp\aadc5ebf5aeb828fd9f4a3a2a5cbe9707f48ec8f3b7eb4cf654dfb7bb6ba7f99.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:1308

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 ecacf0c283c6f4a4a6da1463030a92c508c9e392d0d8dd77fdfd8cdcce7bd28c
MD5 c234bb27d49853ba1fd86ed629664372
SHA1 5a6dc3047e3d43a808c0168a3d18ee665218b9df
SHA512 0d596d970baa4b19b6ee91e9c3d7d4df7f83cc7075948858d1facb171a31157647dc1c5e3c3089d685e7f56f1337e0a286439a12d97d443e16691f2d65b58a29
SSDEEP 1536:Vd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZlLl/5:ddseIOMEZEyFjEOFqTiQm7l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 61KB
SHA256 8c4a38cd66ca3eb97a670b3e094f40732fc5e06fdaa17f7006ba1aa77cd73368
MD5 3fad5bc7c7f2e578402c118588ef2db2
SHA1 6d9856a1d6f7b46c6a55a81e0f37715abc7da8d7
SHA512 cb3a746ed7a51a96165dce4d7d500dfbf490e726803b5b2e518be8518a95bfbb897e1beb69702cb157d87e4620dc69d9e2bab9b68ea3742a32803b02dd3846c4
SSDEEP 1536:rd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZlLl/5:bdseIOMEZEyFjEOFqTiQm7l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download