neconyd | 0004567c1df9032867c9761be04e579c1b0edb53d98f0085e45927ab456a0f64

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e440b3507a2b3d8f96deffba6761b310N.exe
Size 248KB
Sample240725-vlmd7sshjk
SHA256 0004567c1df9032867c9761be04e579c1b0edb53d98f0085e45927ab456a0f64
MD5 e440b3507a2b3d8f96deffba6761b310
SHA1 3d1bf81d7d70e94a6d8ab5e45acefc24f8ab30c2
SHA512 ba8ea2bb59e09d1dd3fd5da835a40055416dccff11b315a5a1e1b351724b4bc2b74360ece56b7bdd3ca4e8a3da25ff193f9ca907648131b46b7310dd36bc5f77
SSDEEP 1536:I4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:IIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
3656	omsecor.exe
4044	omsecor.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4512-0-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/files/0x00080000000234cb-4.dat	upx
behavioral2/memory/3656-6-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/4512-5-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/3656-7-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/files/0x000400000001e744-10.dat	upx
behavioral2/memory/4044-12-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/3656-13-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/4044-14-0x0000000000400000-0x000000000043E000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e440b3507a2b3d8f96deffba6761b310N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 3656	4512	e440b3507a2b3d8f96deffba6761b310N.exe	84
PID 4512 wrote to memory of 3656	4512	e440b3507a2b3d8f96deffba6761b310N.exe	84
PID 4512 wrote to memory of 3656	4512	e440b3507a2b3d8f96deffba6761b310N.exe	84
PID 3656 wrote to memory of 4044	3656	omsecor.exe	99
PID 3656 wrote to memory of 4044	3656	omsecor.exe	99
PID 3656 wrote to memory of 4044	3656	omsecor.exe	99

C:\Users\Admin\AppData\Local\Temp\e440b3507a2b3d8f96deffba6761b310N.exe
"C:\Users\Admin\AppData\Local\Temp\e440b3507a2b3d8f96deffba6761b310N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 248KB
SHA256 efba818b0951c7fbd71b1adc9b1984deb8f50d74e7507a253e4ade89e1e3ee64
MD5 27277c159e0c9b16de25cdc9e7f01558
SHA1 37ab4a984af9c9560600e006668d7b155bd2b900
SHA512 9c448703cb2b0bf60aa847877511ed15daec1c999f6c3c816cdd9c290d2d86e1b90aaf5c0e2b057b94eee6050989344f903923fc8137304458eb63e3b75d03c3
SSDEEP 1536:54d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:5IdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 248KB
SHA256 fa2e00b9bbbcf8ebeb406545e4abc0c87228a21edaea1cb7ac2c7ffec419358b
MD5 fe4b787b3df7d2b633881fb9a734961b
SHA1 aae622fee0139bcb6bdac108619fa60d989ff8d8
SHA512 30eabfbbf895e382c96b5e0c777f29e7eed387968cb70966dcd7872ba33b4991b3eda8d532b20d6e975681527980f4e96f2a7ccda1c8a44e88a7101dd212a1b3
SSDEEP 1536:F4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:FIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3656-6-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3656-7-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3656-13-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4044-12-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4044-14-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4512-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4512-5-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads