neconyd | e51906571f190c29851d86e5a305fdab85be6ae4e3308ccfce5c1bfa005024f3

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 04:01

Target
e51906571f190c29851d86e5a305fdab85be6ae4e3308ccfce5c1bfa005024f3.exe
Size 61KB
Sample240705-elmf7svbmc
SHA256 e51906571f190c29851d86e5a305fdab85be6ae4e3308ccfce5c1bfa005024f3
MD5 be7e04ae37ce5ac2d0a6d4e7e1ff6841
SHA1 baa7336b1e78e30b6f87f6698d6f0e0a89877df2
SHA512 92791a639cf56c6bf0a177c50d785f7b26a1dbaf1c2baf00c5e233cdf44eef660a8694d20408628921df314646329374d4c0135e07cf3a727a036e68f6b6ab60
SSDEEP 768:lMEIvFGvZEr8LFK0ic46N47eSdYAHwmZ7Bp6JXXlaa5uA:lbIvYvZEyFKF6N4yS+AQmZIl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
3944	omsecor.exe
1432	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 3944	4228	e51906571f190c29851d86e5a305fdab85be6ae4e3308ccfce5c1bfa005024f3.exe	83
PID 4228 wrote to memory of 3944	4228	e51906571f190c29851d86e5a305fdab85be6ae4e3308ccfce5c1bfa005024f3.exe	83
PID 4228 wrote to memory of 3944	4228	e51906571f190c29851d86e5a305fdab85be6ae4e3308ccfce5c1bfa005024f3.exe	83
PID 3944 wrote to memory of 1432	3944	omsecor.exe	86
PID 3944 wrote to memory of 1432	3944	omsecor.exe	86
PID 3944 wrote to memory of 1432	3944	omsecor.exe	86

C:\Users\Admin\AppData\Local\Temp\e51906571f190c29851d86e5a305fdab85be6ae4e3308ccfce5c1bfa005024f3.exe
"C:\Users\Admin\AppData\Local\Temp\e51906571f190c29851d86e5a305fdab85be6ae4e3308ccfce5c1bfa005024f3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:1432

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 aeadcc3468481863da836552faec4eb5e715211d20ad200169621521dcea2ddd
MD5 bd6ce06dd45d16f3924ee8d7e193c852
SHA1 bae7c0eda7cf7bc361ed6f279e0f5c24218ab427
SHA512 f93451e2146b18d934039cbae2871a03c6ade02d4978a75bf342417a0c0311a6ccf011678fc6dffa35047905fc606a385166a0ec10d71a08b2cddc9160ae9bab
SSDEEP 768:KMEIvFGvZEr8LFK0ic46N47eSdYAHwmZ7Bp6JXXlaa5uA:KbIvYvZEyFKF6N4yS+AQmZIl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 61KB
SHA256 b22be54f5ef0c87aadabe1db4841102f935316b8e4a56ddff6fd7855dc50f191
MD5 11f7376667f46708e337493a43140d49
SHA1 c2c8cf194fd552ca7cb126f0c8fb396f30c34cea
SHA512 9dd4f2d51053c3d0fc1b1fefc4a994476f0b87cc5f939fedc529d2c1c1e74b26087ce5a55015b8e613b5f35780da1c201f0793618cd17ddc7e3e13c3b7ae5856
SSDEEP 768:VMEIvFGvZEr8LFK0ic46N47eSdYAHwmZ7Bp6JXXlaa5uA:VbIvYvZEyFKF6N4yS+AQmZIl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download