neconyd | e5e5e6167962458c35f2a3a1b35a9b12ab285143b5761930a458ea06d96fc6d8

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 04:45

Target

e5e5e6167962458c35f2a3a1b35a9b12ab285143b5761930a458ea06d96fc6d8.exe
Size

88KB
MD5

407217d4f6cbdf4ac2db283ba2300a31
SHA1

75ac604bdd3a9bd2aa859f97936b8e4355e7589f
SHA256

e5e5e6167962458c35f2a3a1b35a9b12ab285143b5761930a458ea06d96fc6d8
SHA512

ee19b8fa70dadfa922100d820869aed7f01f393739f7cd688d12ac65590d6494cf64b7c125798862ba8f694e9ad73f912eb4771153138b2e67ece5df647c1996
SSDEEP

1536:1d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:9dseIOMEZEyFjEOFqTiQm5l/5

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Executes dropped EXE 3 IoCs

Loads dropped DLL 6 IoCs

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2056	2244	e5e5e6167962458c35f2a3a1b35a9b12ab285143b5761930a458ea06d96fc6d8.exe	28
PID 2244 wrote to memory of 2056	2244	e5e5e6167962458c35f2a3a1b35a9b12ab285143b5761930a458ea06d96fc6d8.exe	28
PID 2244 wrote to memory of 2056	2244	e5e5e6167962458c35f2a3a1b35a9b12ab285143b5761930a458ea06d96fc6d8.exe	28
PID 2244 wrote to memory of 2056	2244	e5e5e6167962458c35f2a3a1b35a9b12ab285143b5761930a458ea06d96fc6d8.exe	28
PID 2056 wrote to memory of 2724	2056	omsecor.exe	32
PID 2056 wrote to memory of 2724	2056	omsecor.exe	32
PID 2056 wrote to memory of 2724	2056	omsecor.exe	32
PID 2056 wrote to memory of 2724	2056	omsecor.exe	32
PID 2724 wrote to memory of 2492	2724	omsecor.exe	33
PID 2724 wrote to memory of 2492	2724	omsecor.exe	33
PID 2724 wrote to memory of 2492	2724	omsecor.exe	33
PID 2724 wrote to memory of 2492	2724	omsecor.exe	33

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
88KB

MD5
eb4e2478ac911ed5235815d95afe5219

SHA1
3bfd3924fd9962e9f07989c7a8f4b4f3f17fe75b

SHA256
72bb6aab576fc0f768f568d1954a13f7327b1b89360616311e89f05a3a4b2dca

SHA512
2b10c1e4516b26a26613d773b645e6548214ac545c1236c3658601c99d720e49468db95958ad54398eb145c1624013f6ce1062999a619ebe60f32a536fbf10a3

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
88KB

MD5
17a761c73b6b0d0330c9bb40e765d0c9

SHA1
2e11dc4ceefabf8979f8a1390ea396486d6e6f17

SHA256
ad40a400a0c0269b92675f12513495d5bbda318f351b0030e6627552bee52bcb

SHA512
67e0387fcc299f50a70f45288e4210ea23bb401a07db0f4052bb1e5e47dbe2e2e369420757b1fb4c8fbf30d9f7e66001bce840bc17ac13161e1c71dd96555798

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
88KB

MD5
40249f428e391465280ed9c5c28fe8bc

SHA1
bfb6c086c0d31ea0a6fee34c9dda77a6ba72c38d

SHA256
e6e1d8c247238277ccca80db38f3cc34183aeb6e0af5d45329e63b28bd044f17

SHA512
3133db07beef385984b1c64e3aeeeaa6181ac317483569c2014072b3064cba1b5cdc396ef9a644dbf33c4a9a0b80b02107250244adaa430fc0b7d760ff62ea58

Download Submit