neconyd | 5c8725b21d51e538d5fe7e010e1c00c418455ef5bfcd922da7d2adbf0134ebf3

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 00:48

Target

4f600b3c249e431b55f753a9b05e5be0N.exe
Size

88KB
MD5

4f600b3c249e431b55f753a9b05e5be0
SHA1

df5254615f7bd8d329fc08f6012c8e5eb293afc0
SHA256

5c8725b21d51e538d5fe7e010e1c00c418455ef5bfcd922da7d2adbf0134ebf3
SHA512

5c6b67149766dd8ced476c80a8b8461df826afa5eebeb93840e14b3358077a769c929081e1b989003af8a4247d6ad98496108ee99da5b443ebcdb10466b972a6
SSDEEP

768:JMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAx:JbIvYvZEyFKF6N4yS+AQmZTl/5Z

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Executes dropped EXE 3 IoCs

Loads dropped DLL 6 IoCs

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2340	1720	4f600b3c249e431b55f753a9b05e5be0N.exe	30
PID 1720 wrote to memory of 2340	1720	4f600b3c249e431b55f753a9b05e5be0N.exe	30
PID 1720 wrote to memory of 2340	1720	4f600b3c249e431b55f753a9b05e5be0N.exe	30
PID 1720 wrote to memory of 2340	1720	4f600b3c249e431b55f753a9b05e5be0N.exe	30
PID 2340 wrote to memory of 2452	2340	omsecor.exe	32
PID 2340 wrote to memory of 2452	2340	omsecor.exe	32
PID 2340 wrote to memory of 2452	2340	omsecor.exe	32
PID 2340 wrote to memory of 2452	2340	omsecor.exe	32
PID 2452 wrote to memory of 1940	2452	omsecor.exe	33
PID 2452 wrote to memory of 1940	2452	omsecor.exe	33
PID 2452 wrote to memory of 1940	2452	omsecor.exe	33
PID 2452 wrote to memory of 1940	2452	omsecor.exe	33

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
88KB

MD5
be3af599abe96a1183325d0c10c439fb

SHA1
96bf81fdc4f33785f530a319b60a8de339f472cd

SHA256
60d2ad533b1aa93e15dc24ac7dbfc2d31d4da7f77f6cbb89ed224c193621153f

SHA512
18e4b75063e6133f61344229291fb70a76377f45e896b0c6b7b692e881684e4e40ae1437855abad3f6df91265788f82cda44e554934d2ad255a6193a20fbfa94

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
88KB

MD5
b0710c0b5db2db53a091fb6a3c3af6d2

SHA1
f05fe37f706d9833c34eb421c708d868038e4a53

SHA256
9fc05d41b9f70e7a4bc43b7f318306b3be87ca7c4eabf4a791e43ae4f5acd325

SHA512
8f7f3aa38dd8a1ccf45586620542014766ad7e601426fa60db152dd6962c9972251fbb2f1bcc3fde728313204194ba8d86bd1dca3a5db9bd27da0dd73dc6b2cf

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
88KB

MD5
11be381f2a54531632490c5f1bcf3fec

SHA1
1360b392a331c7d2bc72af15efdb33d3c74c2495

SHA256
a0092a58ecd90c82594279d4bb7ba9cd2ca36ab1ee873d5af502a7abfa0ba7e2

SHA512
f3951e4fc840e4a2a6185968d87b80626962a066a1567c17aa6fc171f506eaa995e82918a176a27459e071e16a39fb49b328fa7aa4eb4b2a754e3c92253c48bf

Download Submit