neconyd | 64caa902af7f5e57f8e78a1b683e37c83877bbee7bc63f005b550185fa03bc1b

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c31a120b21aacbdb4c1913b80fd02e7_JaffaCakes118.exe
Size 63KB
Sample240724-t5trysygpc
SHA256 64caa902af7f5e57f8e78a1b683e37c83877bbee7bc63f005b550185fa03bc1b
MD5 6c31a120b21aacbdb4c1913b80fd02e7
SHA1 1ae4dbaeeb3b5214214af87791510d0e947c0bc9
SHA512 17955ad19dbd093a8b68dff0567157e644fae18486ddabc90d1e84d7fbff1b030bcbc2111a224e2f223041dd79aea7dae67d6ba1a01abfa02e61dfb96a71768e
SSDEEP 768:QMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:QbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
3508	omsecor.exe
956	omsecor.exe
2204	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c31a120b21aacbdb4c1913b80fd02e7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 3508	3484	6c31a120b21aacbdb4c1913b80fd02e7_JaffaCakes118.exe	84
PID 3484 wrote to memory of 3508	3484	6c31a120b21aacbdb4c1913b80fd02e7_JaffaCakes118.exe	84
PID 3484 wrote to memory of 3508	3484	6c31a120b21aacbdb4c1913b80fd02e7_JaffaCakes118.exe	84
PID 3508 wrote to memory of 956	3508	omsecor.exe	99
PID 3508 wrote to memory of 956	3508	omsecor.exe	99
PID 3508 wrote to memory of 956	3508	omsecor.exe	99
PID 956 wrote to memory of 2204	956	omsecor.exe	100
PID 956 wrote to memory of 2204	956	omsecor.exe	100
PID 956 wrote to memory of 2204	956	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\6c31a120b21aacbdb4c1913b80fd02e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6c31a120b21aacbdb4c1913b80fd02e7_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 63KB
SHA256 7792b3f717cae32a80ad1d104c00f16cf774575d90e2dc1bf8b86f4cccc47d45
MD5 0b372998e69d5ab7878cf98e0599b0ca
SHA1 c5525c05e436d1de493f043cad0705e59dc897ce
SHA512 c006eafc57cd307ef91ee3776cb87fbd310c53cef83d48e6de79a9f8b553262132a0b5ff04da22cab5e7f7b96ffb3a1e4161c3e3ae5df712127e6422446701c5
SSDEEP 768:5MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:5bIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 63KB
SHA256 f92599dad8fe426a7347b6f1bc377671066377bdf8b5ea68133e28f64cd08ca0
MD5 2e72934ad84c726eed68342d8e292f03
SHA1 e60d870d9220d35bf73bbede2b311a06a3a1a894
SHA512 4f1dca510fdfb5f9cba338de4a5804f5f1e61e0a0b79317d91d5aaeb5d3819d78d0f620e493659ac3b1e117e295c9f15d6b577218a750d463c15f111f08aa983
SSDEEP 768:wMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:wbIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 63KB
SHA256 9929491f2c0d1b58ad9e5c085b2febd42867375b4622c66033d2fa1c737c23ce
MD5 d63c0910af08182fea82ee9948499cfe
SHA1 d8507a46ba74b39dba9ccce8f8457de2b6d76116
SHA512 a06ee5e8b3170e5ad243fe92998b7fa3b24023ef18bff0991402252f06f370d91112cf87c42fd66621d215b2a0ec9a5975d1a28572c05106a446cbc9de5bc08f
SSDEEP 768:1MEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAW:1bIvYvZEyFKF6N4yS+AQmZTl/5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads