neconyd | 16c3d1ef15507f44079bca27c4bdc4b75c7a460de84b1567bddfed5ff8bc2c3d

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 19:09

Target
16c3d1ef15507f44079bca27c4bdc4b75c7a460de84b1567bddfed5ff8bc2c3d.exe
Size 84KB
Sample240610-xt41bsxbjg
SHA256 16c3d1ef15507f44079bca27c4bdc4b75c7a460de84b1567bddfed5ff8bc2c3d
MD5 01403bdd22a9e1238dca307ef39e76ef
SHA1 be8c5f3869629f059014540951a8fc454fed1fe9
SHA512 304076299913dea97363f240c1f6d608637901b2adabde448c696f7f6b41873d15e3d4bbf3e6cceab1f898f950d1295c94807ac690798c24fe78d9cd6fe371ab
SSDEEP 768:DMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:DbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
748	omsecor.exe
1020	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 748	4372	16c3d1ef15507f44079bca27c4bdc4b75c7a460de84b1567bddfed5ff8bc2c3d.exe	82
PID 4372 wrote to memory of 748	4372	16c3d1ef15507f44079bca27c4bdc4b75c7a460de84b1567bddfed5ff8bc2c3d.exe	82
PID 4372 wrote to memory of 748	4372	16c3d1ef15507f44079bca27c4bdc4b75c7a460de84b1567bddfed5ff8bc2c3d.exe	82
PID 748 wrote to memory of 1020	748	omsecor.exe	94
PID 748 wrote to memory of 1020	748	omsecor.exe	94
PID 748 wrote to memory of 1020	748	omsecor.exe	94

C:\Users\Admin\AppData\Local\Temp\16c3d1ef15507f44079bca27c4bdc4b75c7a460de84b1567bddfed5ff8bc2c3d.exe
"C:\Users\Admin\AppData\Local\Temp\16c3d1ef15507f44079bca27c4bdc4b75c7a460de84b1567bddfed5ff8bc2c3d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:1020

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 84KB
SHA256 a61e4e5ad6180c3acef4da08872419be4a1923b17834375459de40053d4ca296
MD5 30b8beb2a565bceba6a3043f5c333a37
SHA1 3b16ba678e6e9effa246643451d11e1064d01515
SHA512 b2bec55fea63b9b79df887c2360ff892d542abe14cb130aff64268ca8fe6c377464454fba5e53796ab6f0c7f07172709771f4bd060b25f9f9d5e393269005429
SSDEEP 768:zMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:zbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 84KB
SHA256 8edee621c6956bef4286436ae9c8c8d46bad5dd484498438ba2a340f57e0e8dc
MD5 dc58b3c20e4420d4c2b9794a6f112025
SHA1 9c1f165dea5f431757b198cf37885106ef9804e1
SHA512 f3d9e04e33273da1ef121cdcfdee6ee06d1691263a51ebf98dcc4d344cd4ed4ea04654581fbb574e4634b3ac8ce3fe76395118ce8f1fa5186952fe19500300dc
SSDEEP 768:xMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:xbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download