neconyd | bf85cdd65cd3fee1ff665c59f1998790255fc9fbf4f3f64d5c9e290b15694b05

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 21:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d32fcf9827ede320c094d034786bad0N.exe
Size 96KB
Sample240724-zz49dszfpc
SHA256 bf85cdd65cd3fee1ff665c59f1998790255fc9fbf4f3f64d5c9e290b15694b05
MD5 0d32fcf9827ede320c094d034786bad0
SHA1 daa32dd74c2974e3aa775fb3c9af3ac28663891a
SHA512 a3ca9c0920a82ed85a59ef74bdeaf678c2b896ccb3b8ff85f583784142b1617e3f241471be9b562f8c4a19691074cc34a5add4b69cfae3e44a8fb30dcaf485c7
SSDEEP 1536:HnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:HGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
1108	omsecor.exe
216	omsecor.exe
2020	omsecor.exe
4760	omsecor.exe
1364	omsecor.exe
1188	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 368 set thread context of 400	368	0d32fcf9827ede320c094d034786bad0N.exe	84
PID 1108 set thread context of 216	1108	omsecor.exe	89
PID 2020 set thread context of 4760	2020	omsecor.exe	108
PID 1364 set thread context of 1188	1364	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1404	368	WerFault.exe	83
4992	1108	WerFault.exe	87
2308	2020	WerFault.exe	107
4520	1364	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d32fcf9827ede320c094d034786bad0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d32fcf9827ede320c094d034786bad0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 400	368	0d32fcf9827ede320c094d034786bad0N.exe	84
PID 368 wrote to memory of 400	368	0d32fcf9827ede320c094d034786bad0N.exe	84
PID 368 wrote to memory of 400	368	0d32fcf9827ede320c094d034786bad0N.exe	84
PID 368 wrote to memory of 400	368	0d32fcf9827ede320c094d034786bad0N.exe	84
PID 368 wrote to memory of 400	368	0d32fcf9827ede320c094d034786bad0N.exe	84
PID 400 wrote to memory of 1108	400	0d32fcf9827ede320c094d034786bad0N.exe	87
PID 400 wrote to memory of 1108	400	0d32fcf9827ede320c094d034786bad0N.exe	87
PID 400 wrote to memory of 1108	400	0d32fcf9827ede320c094d034786bad0N.exe	87
PID 1108 wrote to memory of 216	1108	omsecor.exe	89
PID 1108 wrote to memory of 216	1108	omsecor.exe	89
PID 1108 wrote to memory of 216	1108	omsecor.exe	89
PID 1108 wrote to memory of 216	1108	omsecor.exe	89
PID 1108 wrote to memory of 216	1108	omsecor.exe	89
PID 216 wrote to memory of 2020	216	omsecor.exe	107
PID 216 wrote to memory of 2020	216	omsecor.exe	107
PID 216 wrote to memory of 2020	216	omsecor.exe	107
PID 2020 wrote to memory of 4760	2020	omsecor.exe	108
PID 2020 wrote to memory of 4760	2020	omsecor.exe	108
PID 2020 wrote to memory of 4760	2020	omsecor.exe	108
PID 2020 wrote to memory of 4760	2020	omsecor.exe	108
PID 2020 wrote to memory of 4760	2020	omsecor.exe	108
PID 4760 wrote to memory of 1364	4760	omsecor.exe	110
PID 4760 wrote to memory of 1364	4760	omsecor.exe	110
PID 4760 wrote to memory of 1364	4760	omsecor.exe	110
PID 1364 wrote to memory of 1188	1364	omsecor.exe	112
PID 1364 wrote to memory of 1188	1364	omsecor.exe	112
PID 1364 wrote to memory of 1188	1364	omsecor.exe	112
PID 1364 wrote to memory of 1188	1364	omsecor.exe	112
PID 1364 wrote to memory of 1188	1364	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\0d32fcf9827ede320c094d034786bad0N.exe
"C:\Users\Admin\AppData\Local\Temp\0d32fcf9827ede320c094d034786bad0N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:368
- C:\Users\Admin\AppData\Local\Temp\0d32fcf9827ede320c094d034786bad0N.exe
  C:\Users\Admin\AppData\Local\Temp\0d32fcf9827ede320c094d034786bad0N.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:216
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2020
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1364
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 264
        8⤵
        Program crash
        
        PID:4520
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 292
        6⤵
        Program crash
        
        PID:2308
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 300
      4⤵
      Program crash
      PID:4992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 300
  2⤵
  - Program crash
  PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 368 -ip 368
1⤵
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1108 -ip 1108
1⤵
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2020 -ip 2020
1⤵
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1364 -ip 1364
1⤵
PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 2268f43b0151a069d5c1b825e1b3c06c32787975828fe0cc1c5bc38dd77888d8
MD5 e0eff4fc6ec42a425a36e2b47497d7af
SHA1 0168bbc19b856743079be00522478201bde9e194
SHA512 83b967a1fb30c4a3c58a5e77a1630d46cade95217913a5f8c39c168c678d2fc04d9042d8f9a3138e4a071ba418a909e9ca941f52708be5d5dd32050eedc63be9
SSDEEP 1536:XnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:XGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 700f430e5443ce291dc56b68b2c3519daea4d8da55d05311826a5e1e90ac19d0
MD5 af36ea1764508f36077472dcb672e0ff
SHA1 613b4febb593cc42626d3c8917f14ee716e0db57
SHA512 e518128af55154e23290112f3b773ac91a7f176492d8004c1affa0671b3dbda9808d43fcee12b6debff6c621eab7ce7d93841691d3030dd5a68fb717a0f1b4ed
SSDEEP 1536:vnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:vGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 c76bad51dbf4076843d332648bf7e6555cb5a7486aee824a0bbf99acccdfcd5c
MD5 58431a4505eafa3656911165943ec41b
SHA1 875f478a4f6669343acba3f1e7204fb8074e7712
SHA512 4121a2756d26a04f67b45df881162ac07622535e547c4d229ba933337da4e636cb3c5d11527aab2a8d722c4838807af0c5906726519a7656aa190f541c816c62
SSDEEP 1536:fnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:fGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-16-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/216-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/216-31-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/216-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/216-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/216-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/216-27-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/368-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/368-18-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/400-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/400-9-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/400-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/400-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1108-10-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1108-19-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1188-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1188-50-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1188-54-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1364-45-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2020-34-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2020-52-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4760-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4760-38-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4760-40-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads