neconyd | 522fca5a9e94f179aaa072aed0402c73f855feedb8b143969189f8d11a87d7b1

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6d085ab6b8f4ba2db485a023676ed45a_JaffaCakes118.exe
Size 64KB
Sample240724-2c73wa1bpr
SHA256 522fca5a9e94f179aaa072aed0402c73f855feedb8b143969189f8d11a87d7b1
MD5 6d085ab6b8f4ba2db485a023676ed45a
SHA1 71274c8e559c376d376b6652d3cc36bc276b1f7d
SHA512 bf02b20b20ee213326c5d44b01931d3d291b2a9e7f7197c2d044e1755b5b525f4b93dc97016ff6095e9a381a5f424cf076f7be909245abd2451df01b71a040d2
SSDEEP 768:bfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:bfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2116	omsecor.exe
2536	omsecor.exe
4312	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d085ab6b8f4ba2db485a023676ed45a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 2116	3364	6d085ab6b8f4ba2db485a023676ed45a_JaffaCakes118.exe	84
PID 3364 wrote to memory of 2116	3364	6d085ab6b8f4ba2db485a023676ed45a_JaffaCakes118.exe	84
PID 3364 wrote to memory of 2116	3364	6d085ab6b8f4ba2db485a023676ed45a_JaffaCakes118.exe	84
PID 2116 wrote to memory of 2536	2116	omsecor.exe	99
PID 2116 wrote to memory of 2536	2116	omsecor.exe	99
PID 2116 wrote to memory of 2536	2116	omsecor.exe	99
PID 2536 wrote to memory of 4312	2536	omsecor.exe	100
PID 2536 wrote to memory of 4312	2536	omsecor.exe	100
PID 2536 wrote to memory of 4312	2536	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\6d085ab6b8f4ba2db485a023676ed45a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6d085ab6b8f4ba2db485a023676ed45a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 63afc0dff87f73180c197b6dab2489b962cca9dad82d60e703319898490ea8fa
MD5 c01a2546e48bf526913b9d9d51e42426
SHA1 1bb296a0569b041b5fe61a862d231b6ab3103fa4
SHA512 1a162723025eecb74cf1ec3ec61b0edf728a65030f9e0749ff9f40f0252bebc140029109921eabc0a824a7d64cffb9d5807e75869e662c9614027703bab5c460
SSDEEP 768:LfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:LfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 64KB
SHA256 883096242f7340c0f1f021366cadedea1019693e3968454b5bf2c2ae192a1e2b
MD5 24eee1c2ac7084a157c8ada6c3592537
SHA1 ed6da6b9c497b3f1ea5788424a471be8f1aaebe9
SHA512 163fbbe764397429a40ea40c6a3159129d02a6ca32bbb8e712035c889657878cd350f82c2c96b9cdaa0c4f0d602d4f93806a4d36f24eb51f85c6f4d867b5d392
SSDEEP 768:LfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:LfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 64KB
SHA256 769068df6b39bff525946cdfb46844f43c0fa7d9c00a24902135d0d6433f80a2
MD5 50cdb0b25a5a6ef9b6567f3d2b6f937d
SHA1 c4091c83f9c43cacd2d29f46537e078897ac58d4
SHA512 568d0f33bded38de088d5b52b47148058cee4bfb4beffeae39aaa13de598605410c351ca460ea9db674b980114ba296a53532f01aa8f1038f7318f1b357908d7
SSDEEP 768:TfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:TfbIvYvZEyFKF6N4yS+AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads