neconyd | 5690e277e56ecbbd0701366636b511715ece839feaab593a38a0d48ec3bdad69

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2024 23:49

Target

5690e277e56ecbbd0701366636b511715ece839feaab593a38a0d48ec3bdad69.exe
Size

92KB
MD5

9fcffd8c288108ea541c8845aab398cf
SHA1

79e9f5369930dd74b9a69af9a795ab8f4bc16fe7
SHA256

5690e277e56ecbbd0701366636b511715ece839feaab593a38a0d48ec3bdad69
SHA512

49ff20163d431f26d3eab07a0e4fd69f0b8d41507305100f483271999b8816a2e3bec10b1ca4f49bcd46eb0e49b320fefc7bb5d9126abe887d440297e2e22465
SSDEEP

768:3MEIvFGvZEh8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:3bIvYvZEgFKF6N4yS+AQmZTl/5

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Executes dropped EXE 2 IoCs

Processes:

omsecor.exeomsecor.exe

pid process

3656 omsecor.exe
3464 omsecor.exe
Drops file in System32 directory 2 IoCs

Processes:

omsecor.exeomsecor.exe

description ioc process

File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe
File opened for modification C:\Windows\SysWOW64\merocz.xc6 omsecor.exe

pid	process
3656	omsecor.exe
3464	omsecor.exe

description	ioc	process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5690e277e56ecbbd0701366636b511715ece839feaab593a38a0d48ec3bdad69.exeomsecor.exe

description	pid	process	target process
PID 3364 wrote to memory of 3656	3364	5690e277e56ecbbd0701366636b511715ece839feaab593a38a0d48ec3bdad69.exe	omsecor.exe
PID 3364 wrote to memory of 3656	3364	5690e277e56ecbbd0701366636b511715ece839feaab593a38a0d48ec3bdad69.exe	omsecor.exe
PID 3364 wrote to memory of 3656	3364	5690e277e56ecbbd0701366636b511715ece839feaab593a38a0d48ec3bdad69.exe	omsecor.exe
PID 3656 wrote to memory of 3464	3656	omsecor.exe	omsecor.exe
PID 3656 wrote to memory of 3464	3656	omsecor.exe	omsecor.exe
PID 3656 wrote to memory of 3464	3656	omsecor.exe	omsecor.exe

C:\Users\Admin\AppData\Local\Temp\5690e277e56ecbbd0701366636b511715ece839feaab593a38a0d48ec3bdad69.exe
"C:\Users\Admin\AppData\Local\Temp\5690e277e56ecbbd0701366636b511715ece839feaab593a38a0d48ec3bdad69.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3780 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:2268

C:\Users\Admin\AppData\Roaming\omsecor.exe
Filesize
92KB

MD5
9d9aa122962490d224d482fa5399d3ae

SHA1
916388a7d08cd2e519033d7f172391a512cf9272

SHA256
92aad438f3ed97b0902fa179d086365440228d6d9e1062a3d8c0bcf4516a99fe

SHA512
e7a9234abce8c5d8f365abba26318831f435ff7b28c7a81f14f4838f72994838a049452b029718b2f725e41334feebcb6fb085b42cd14defa9ed8c14416b51bb

Download Submit
C:\Windows\SysWOW64\omsecor.exe
Filesize
92KB

MD5
c90eff8542fab414f099dd6c9d4510dc

SHA1
3cb783e53e00c3e18721eab376906fa568a88c5e

SHA256
40e318c06878398e88c25099cc3e39b6301e61f2d8b9983626b9cafa4de4600e

SHA512
f1baa99c77b18efb3d67e25ef6a550fadccb945d347dda32e2bf366fc31afa2c9841c4ecac2481cdab4b3a2ce1b856249daedc57bda54411d68bb695291b0a0a

Download Submit
memory/3364-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3364-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3464-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3464-14-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3656-4-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3656-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3656-13-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download