neconyd | 8e7c12f620d6efdb5c32711a2c5d81d2e28374945391e956b93eebdc87d88e92

Analysis

max time kernel
114s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 20:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f20ac374ee9600bae3a572071b433750N.exe
Size 35KB
Sample240725-yv5tpavfkd
SHA256 8e7c12f620d6efdb5c32711a2c5d81d2e28374945391e956b93eebdc87d88e92
MD5 f20ac374ee9600bae3a572071b433750
SHA1 4090d25006147999c73b1482bf355973701dfe9c
SHA512 af3540626d7b704dd3134857b2c0fddf29594e80e94a657a34e37202da68cede1d17273ee3c1b04da95ef2b1011cf195a40490d546344be65a5e625bce6c53a8
SSDEEP 768:26vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:N8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
828	omsecor.exe
2436	omsecor.exe
4764	omsecor.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2496-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x0009000000023468-2.dat	upx
behavioral2/memory/828-4-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2496-7-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/828-8-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/828-11-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/828-14-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/828-15-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x000400000001e744-18.dat	upx
behavioral2/memory/828-20-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x0009000000023468-25.dat	upx
behavioral2/memory/2436-23-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4764-28-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4764-29-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f20ac374ee9600bae3a572071b433750N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 828	2496	f20ac374ee9600bae3a572071b433750N.exe	86
PID 2496 wrote to memory of 828	2496	f20ac374ee9600bae3a572071b433750N.exe	86
PID 2496 wrote to memory of 828	2496	f20ac374ee9600bae3a572071b433750N.exe	86
PID 828 wrote to memory of 2436	828	omsecor.exe	102
PID 828 wrote to memory of 2436	828	omsecor.exe	102
PID 828 wrote to memory of 2436	828	omsecor.exe	102
PID 2436 wrote to memory of 4764	2436	omsecor.exe	103
PID 2436 wrote to memory of 4764	2436	omsecor.exe	103
PID 2436 wrote to memory of 4764	2436	omsecor.exe	103

C:\Users\Admin\AppData\Local\Temp\f20ac374ee9600bae3a572071b433750N.exe
"C:\Users\Admin\AppData\Local\Temp\f20ac374ee9600bae3a572071b433750N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 8ec7fe56128c41d2115b4aa7547e1241e5603a01bf31cbcb12d6d5503268762a
MD5 32319647cb1f9a951337805d8b3617dc
SHA1 276f1796c96f9517ace2c5bc50150e86a338f479
SHA512 522dccfe3263451c9f78b851f6af4901a4c2d66fbb96ceffca33bbcc9ccdaf18222904827f441386ee39f4924931fdd13b62e53f1150d37fba6be0e559b09aed
SSDEEP 768:m6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:98Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 458e636ceb171aefe62e83b97ce2232946d3f925cd4b41af3e3a03a0891b6a23
MD5 8b6efa85a081ccc45679d522fdf38b60
SHA1 05896b70208a74de146230edb184b1cdccb15662
SHA512 809bdcbb84ec66c3898cf907135755e17e3e81e6c4908a963e3d95b8346ef08207d8b6b52c63a4f42421060d57727d730c3aacd533bc4f9eb9da39733c8b1168
SSDEEP 768:E6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:T8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 35KB
SHA256 7a867cb355173c13c1e9f14d862221ad3d0807a80f13e115e563f10c7c7aaf4a
MD5 51ec6c825076e5de9b6efacbc1972bb6
SHA1 25182b1f5a9e07ead1c6779c1a0d0d11a7900bd7
SHA512 dc9f0ea12f8fe932b93c517dce4f5d0ce150322f7b1a2237827471ba57d3dacc101886ab365bc90fff300573826b768caaf57decb9e195070210a85ad3045eb9
SSDEEP 768:R6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:c8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/828-20-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/828-8-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/828-11-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/828-14-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/828-15-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/828-4-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2436-23-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2496-7-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2496-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4764-28-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4764-29-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads