neconyd | 5a93186c290d62ba1631b75affb13915af593b50d3ce2d8aa17c4d6f45a1eb14

Analysis

max time kernel
142s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-06-2024 22:31

Target

5a93186c290d62ba1631b75affb13915af593b50d3ce2d8aa17c4d6f45a1eb14.exe
Size

76KB
MD5

0ea8c24805504a09f0875abbb81bab14
SHA1

db97edd57526877cbc1f9ac919db244b7c642636
SHA256

5a93186c290d62ba1631b75affb13915af593b50d3ce2d8aa17c4d6f45a1eb14
SHA512

64d9fec3ab72577c83622418f4bfd9f1510f1146442e90788b824c35b50409327a78c8cb50877acd128b552d800f87f7c3602899428d131a2bc51c16ee6a04e1
SSDEEP

768:mMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:mbIvYvZEyFKF6N4yS+AQmZTl/5O

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Executes dropped EXE 3 IoCs

Processes:

omsecor.exeomsecor.exeomsecor.exe

pid process

4884 omsecor.exe
1196 omsecor.exe
1612 omsecor.exe
Drops file in System32 directory 1 IoCs

Processes:

omsecor.exe

description ioc process

File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe

description	ioc	process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

5a93186c290d62ba1631b75affb13915af593b50d3ce2d8aa17c4d6f45a1eb14.exeomsecor.exeomsecor.exe

description	pid	process	target process
PID 4568 wrote to memory of 4884	4568	5a93186c290d62ba1631b75affb13915af593b50d3ce2d8aa17c4d6f45a1eb14.exe	omsecor.exe
PID 4568 wrote to memory of 4884	4568	5a93186c290d62ba1631b75affb13915af593b50d3ce2d8aa17c4d6f45a1eb14.exe	omsecor.exe
PID 4568 wrote to memory of 4884	4568	5a93186c290d62ba1631b75affb13915af593b50d3ce2d8aa17c4d6f45a1eb14.exe	omsecor.exe
PID 4884 wrote to memory of 1196	4884	omsecor.exe	omsecor.exe
PID 4884 wrote to memory of 1196	4884	omsecor.exe	omsecor.exe
PID 4884 wrote to memory of 1196	4884	omsecor.exe	omsecor.exe
PID 1196 wrote to memory of 1612	1196	omsecor.exe	omsecor.exe
PID 1196 wrote to memory of 1612	1196	omsecor.exe	omsecor.exe
PID 1196 wrote to memory of 1612	1196	omsecor.exe	omsecor.exe

C:\Users\Admin\AppData\Local\Temp\5a93186c290d62ba1631b75affb13915af593b50d3ce2d8aa17c4d6f45a1eb14.exe
"C:\Users\Admin\AppData\Local\Temp\5a93186c290d62ba1631b75affb13915af593b50d3ce2d8aa17c4d6f45a1eb14.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4568

C:\Users\Admin\AppData\Roaming\omsecor.exe
C:\Users\Admin\AppData\Roaming\omsecor.exe
4⤵
- Executes dropped EXE
PID:1612

C:\Users\Admin\AppData\Roaming\omsecor.exe
Filesize
76KB

MD5
a5124f4bdc4b120f2b93f270d7a4d667

SHA1
40ef17b4718e0331569a392d7ee77df0b1d3b5bb

SHA256
50dae432002b9634e8ae1ea6080dd48c2ff23a8ac4484a1449489e63e43beb80

SHA512
e108fd5825f4b53f5eb3aeadbe1aecbaccafe1b10676b902c1c1a1715896ca73f6e1c0e839201a11cec2e46133100faafcab540cfc0986bbf0d7540777d92893

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe
Filesize
76KB

MD5
2e8019e159cf6169599b9db9225c7927

SHA1
ff3e20b23bf0902efb8f9f59d4f58508ccca9fbe

SHA256
dcf94d8e0a70fdcb693212efdfb8e1fd9664d8d19f3d22256b8c3d68b35a210d

SHA512
b50c2e54f3febb5b5a1bab7015def0df5ab98549644c59cf8e91ba58a74ae9e536cab1766c57136a1a709a231be94da51400729e23169d8fa11fa29d16f51385

Download Submit
C:\Windows\SysWOW64\omsecor.exe
Filesize
76KB

MD5
61ed4fbe79ddb13a85b1645a78c4479c

SHA1
c392e638787a43483e5185dd2652fa73ec029e7b

SHA256
5f5bf8a31e343dbbf6528d3d6353d1688a715f61f9d10c15d6b3147ad8fe1474

SHA512
a82e4092efc4bd0a353704aee62a543066f4a66ee8eb57ef44d5cd03d2bc3d4e49490f0d62f82b6deca1711e091157fcfb8079b3fc5e2b6d057553e0b8fa6839

Download Submit