neconyd | 35585f531eeefe69bba7ae394611b8a5c511e58f7186b328747f546bc457fc5b

Analysis

max time kernel
116s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b16cac9826f43b64f894ef27f30e930N.exe
Size 134KB
Sample240725-bt764azcmk
SHA256 35585f531eeefe69bba7ae394611b8a5c511e58f7186b328747f546bc457fc5b
MD5 4b16cac9826f43b64f894ef27f30e930
SHA1 5c80275ec8e936e60742173824371c455a431ac4
SHA512 48b5818d22cce6562df0b257f38b48e4139bf72dca298da8352487ca94e6c5c054873cd0240dd8072ba3f0ffed6ee56148b6bf860ff5d1043bfa6bff4da5c43d
SSDEEP 1536:RDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:xiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
924	omsecor.exe
1020	omsecor.exe
828	omsecor.exe
1996	omsecor.exe
4812	omsecor.exe
3720	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2972 set thread context of 992	2972	4b16cac9826f43b64f894ef27f30e930N.exe	84
PID 924 set thread context of 1020	924	omsecor.exe	89
PID 828 set thread context of 1996	828	omsecor.exe	108
PID 4812 set thread context of 3720	4812	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3024	2972	WerFault.exe	83
1212	924	WerFault.exe	86
4196	828	WerFault.exe	107
1196	4812	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b16cac9826f43b64f894ef27f30e930N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b16cac9826f43b64f894ef27f30e930N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 992	2972	4b16cac9826f43b64f894ef27f30e930N.exe	84
PID 2972 wrote to memory of 992	2972	4b16cac9826f43b64f894ef27f30e930N.exe	84
PID 2972 wrote to memory of 992	2972	4b16cac9826f43b64f894ef27f30e930N.exe	84
PID 2972 wrote to memory of 992	2972	4b16cac9826f43b64f894ef27f30e930N.exe	84
PID 2972 wrote to memory of 992	2972	4b16cac9826f43b64f894ef27f30e930N.exe	84
PID 992 wrote to memory of 924	992	4b16cac9826f43b64f894ef27f30e930N.exe	86
PID 992 wrote to memory of 924	992	4b16cac9826f43b64f894ef27f30e930N.exe	86
PID 992 wrote to memory of 924	992	4b16cac9826f43b64f894ef27f30e930N.exe	86
PID 924 wrote to memory of 1020	924	omsecor.exe	89
PID 924 wrote to memory of 1020	924	omsecor.exe	89
PID 924 wrote to memory of 1020	924	omsecor.exe	89
PID 924 wrote to memory of 1020	924	omsecor.exe	89
PID 924 wrote to memory of 1020	924	omsecor.exe	89
PID 1020 wrote to memory of 828	1020	omsecor.exe	107
PID 1020 wrote to memory of 828	1020	omsecor.exe	107
PID 1020 wrote to memory of 828	1020	omsecor.exe	107
PID 828 wrote to memory of 1996	828	omsecor.exe	108
PID 828 wrote to memory of 1996	828	omsecor.exe	108
PID 828 wrote to memory of 1996	828	omsecor.exe	108
PID 828 wrote to memory of 1996	828	omsecor.exe	108
PID 828 wrote to memory of 1996	828	omsecor.exe	108
PID 1996 wrote to memory of 4812	1996	omsecor.exe	110
PID 1996 wrote to memory of 4812	1996	omsecor.exe	110
PID 1996 wrote to memory of 4812	1996	omsecor.exe	110
PID 4812 wrote to memory of 3720	4812	omsecor.exe	112
PID 4812 wrote to memory of 3720	4812	omsecor.exe	112
PID 4812 wrote to memory of 3720	4812	omsecor.exe	112
PID 4812 wrote to memory of 3720	4812	omsecor.exe	112
PID 4812 wrote to memory of 3720	4812	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\4b16cac9826f43b64f894ef27f30e930N.exe
"C:\Users\Admin\AppData\Local\Temp\4b16cac9826f43b64f894ef27f30e930N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\4b16cac9826f43b64f894ef27f30e930N.exe
  C:\Users\Admin\AppData\Local\Temp\4b16cac9826f43b64f894ef27f30e930N.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1020
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:828
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 268
        8⤵
        Program crash
        
        PID:1196
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 292
        6⤵
        Program crash
        
        PID:4196
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 276
      4⤵
      Program crash
      PID:1212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 288
  2⤵
  - Program crash
  PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2972 -ip 2972
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 924 -ip 924
1⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 828 -ip 828
1⤵
PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4812 -ip 4812
1⤵
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 f43da56e95cb4595b9ed025ccb9a2238c5af6fd89ace6125aef1c6a56a4ba238
MD5 f86ced45c500d05fbeb1601352b4f886
SHA1 ed480405fb31897de718f4ba993758be7cc7fc20
SHA512 1a749a2618aa07f773a8461053c8fb55525e81dc1525e718ef19fd8bb57c251660e605d33c4c291efe5f887e8d71fc4d86fae2be39d1a25a43a1a4f63e5317e4
SSDEEP 1536:UDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:qiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 af7c583fec0233b9133b718b0c31095a09706aa0c45de5877d4ccc7b21c18b09
MD5 75d57fb9635138fa322ec090cfbb51dd
SHA1 57fe77fcaf48112f16fc0e1884e0a9fb8da96b98
SHA512 92e05da77323cd5d17ebc24a28534de919f70229fbf42dfef7f144362885ad3e2be072adaf7aa8ca2b51d7612e80d7ac43c2b1d453d8e07a3017381201d43329
SSDEEP 1536:BDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:hiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 134KB
SHA256 4104bf9f4f307637819da5590dc85df673b374f2cff2a2c535b2573739e40d2f
MD5 4e4f6aac3615d21b53e881f96bf223f4
SHA1 08cee631f5f0e735c8584e614947cf7ad4ec6266
SHA512 088286ba1a62ede9e6f05a52852b0563a99ec5d6af10c01b0b82d70e4a5a164cbdd19f3d4e9c6e716c1e19329999fea77d269aa0be6dacc1ddb8e5875ef4a402
SSDEEP 1536:VDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:1iRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/828-33-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/924-18-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/924-9-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/992-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/992-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/992-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/992-8-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1020-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1020-16-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1020-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1020-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1020-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1020-29-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1020-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1996-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1996-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1996-43-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2972-17-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2972-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3720-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3720-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3720-50-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4812-44-0x0000000000400000-0x0000000000424000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads