neconyd | aa47612960ba3709e0694d26810dab5beb3df7bcb2a0007ec2c1eafe5454d56a

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-06-2024 02:07

Target

aa47612960ba3709e0694d26810dab5beb3df7bcb2a0007ec2c1eafe5454d56a.exe
Size

84KB
MD5

532d13d1bd64f4149bb0b84fd7c588b3
SHA1

2452ef112f3ecfb09df42ffd312a5d3fef9e5f9a
SHA256

aa47612960ba3709e0694d26810dab5beb3df7bcb2a0007ec2c1eafe5454d56a
SHA512

d0c943e620ee833e14f53acdbd0b36e4e189a18d3d86682ed9ecee63cf91a63842c9fc1c8ef16b85f7471b24f37b09c6b34140a9f545518a1d07a46b35379c39
SSDEEP

768:qMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:qbIvYvZEyFKF6N4yS+AQmZTl/5

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Executes dropped EXE 3 IoCs

Processes:

omsecor.exeomsecor.exeomsecor.exe

pid process

2192 omsecor.exe
1736 omsecor.exe
2316 omsecor.exe

Loads dropped DLL 6 IoCs

Processes:

aa47612960ba3709e0694d26810dab5beb3df7bcb2a0007ec2c1eafe5454d56a.exeomsecor.exeomsecor.exe

pid	process
2180	aa47612960ba3709e0694d26810dab5beb3df7bcb2a0007ec2c1eafe5454d56a.exe
2180	aa47612960ba3709e0694d26810dab5beb3df7bcb2a0007ec2c1eafe5454d56a.exe
2192	omsecor.exe
2192	omsecor.exe
1736	omsecor.exe
1736	omsecor.exe

Drops file in System32 directory 1 IoCs

Processes:

omsecor.exe

description ioc process

File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe

description	ioc	process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

aa47612960ba3709e0694d26810dab5beb3df7bcb2a0007ec2c1eafe5454d56a.exeomsecor.exeomsecor.exe

description	pid	process	target process
PID 2180 wrote to memory of 2192	2180	aa47612960ba3709e0694d26810dab5beb3df7bcb2a0007ec2c1eafe5454d56a.exe	omsecor.exe
PID 2180 wrote to memory of 2192	2180	aa47612960ba3709e0694d26810dab5beb3df7bcb2a0007ec2c1eafe5454d56a.exe	omsecor.exe
PID 2180 wrote to memory of 2192	2180	aa47612960ba3709e0694d26810dab5beb3df7bcb2a0007ec2c1eafe5454d56a.exe	omsecor.exe
PID 2180 wrote to memory of 2192	2180	aa47612960ba3709e0694d26810dab5beb3df7bcb2a0007ec2c1eafe5454d56a.exe	omsecor.exe
PID 2192 wrote to memory of 1736	2192	omsecor.exe	omsecor.exe
PID 2192 wrote to memory of 1736	2192	omsecor.exe	omsecor.exe
PID 2192 wrote to memory of 1736	2192	omsecor.exe	omsecor.exe
PID 2192 wrote to memory of 1736	2192	omsecor.exe	omsecor.exe
PID 1736 wrote to memory of 2316	1736	omsecor.exe	omsecor.exe
PID 1736 wrote to memory of 2316	1736	omsecor.exe	omsecor.exe
PID 1736 wrote to memory of 2316	1736	omsecor.exe	omsecor.exe
PID 1736 wrote to memory of 2316	1736	omsecor.exe	omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
4⤵
- Executes dropped EXE
PID:2316

\Users\Admin\AppData\Roaming\omsecor.exe
Filesize
84KB

MD5
048a61ebf337883ade9242606a93746f

SHA1
ab71eeced3045e5bef065f2e3c293071738414d9

SHA256
69eebc98ecbe8c656923eb8af8dcca8e73a882398f068d43e6a3013c7631b40b

SHA512
dd1cef4ec4b77df2d5df8688d4ea3403266cba05eaa3ba8e44c77df87eb00d112992c86253982f8a7b73a110291dd4b635b7e7aca26859d5cb4bcae96eeb6586

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe
Filesize
84KB

MD5
8efad5a7cce45ad1d2b9315ef2528dc9

SHA1
538da7281d56a8135b1514cd18bf82a45e57f863

SHA256
bae39042cabefb6687f8d6227a43f5349e71c98edb0a56b5c57d483cf68c86c3

SHA512
db94276200e136d9d609fa3c5b283df51be20329296c15fd7f57571be5bbf5421dd99320065c3819c9fd8bfbaa56a54b69a1a96c27218dbaed7c74bfa72c8fc8

Download Submit
\Windows\SysWOW64\omsecor.exe
Filesize
84KB

MD5
fcd4d04d3aed2c64a98c7ebbe04da9b9

SHA1
bccee88e26c8b2cdfef7e533fd9932f93323f874

SHA256
62d3f880f1121a10aa5dab92c56a7082bed247ef977160b949c5524dbf2b9c5e

SHA512
9044287fc3e15a27caa7cb95acbbf5f34a6a0ff0c8f0d93a8c4fdd5513c54dd72bbaf22155c8316d70c4b58b7024c627452c9ef0960167960aa910cf01d0442f

Download Submit