neconyd | 9fc0b5e6b373b10d8655371de7cf532bcc7cf12395816ce78d5e14dcb77ac14d

Analysis

max time kernel
115s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c6f20a0029feb339a27186d5be8a6f0N.exe
Size 80KB
Sample240726-3sgfjaselk
SHA256 9fc0b5e6b373b10d8655371de7cf532bcc7cf12395816ce78d5e14dcb77ac14d
MD5 6c6f20a0029feb339a27186d5be8a6f0
SHA1 2271c3294377aeb18cf67a28b342c4138ad2cf22
SHA512 a166f28c368372326ed2d752ea1169136d636bef86f3735d934e54e4322c2bf6e14eeeb948c71ad4f0cc9f780faeda9c46a2ba530691e8958020965e59c18130
SSDEEP 1536:Id9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZcl/52izbR9Xwzz:4dseIOMEZEyFjEOFqTiQmOl/5xPvw3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
3304	omsecor.exe
4424	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c6f20a0029feb339a27186d5be8a6f0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 3304	748	6c6f20a0029feb339a27186d5be8a6f0N.exe	84
PID 748 wrote to memory of 3304	748	6c6f20a0029feb339a27186d5be8a6f0N.exe	84
PID 748 wrote to memory of 3304	748	6c6f20a0029feb339a27186d5be8a6f0N.exe	84
PID 3304 wrote to memory of 4424	3304	omsecor.exe	99
PID 3304 wrote to memory of 4424	3304	omsecor.exe	99
PID 3304 wrote to memory of 4424	3304	omsecor.exe	99

C:\Users\Admin\AppData\Local\Temp\6c6f20a0029feb339a27186d5be8a6f0N.exe
"C:\Users\Admin\AppData\Local\Temp\6c6f20a0029feb339a27186d5be8a6f0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 80KB
SHA256 44a83f18ee5ed2352e2fd9b2555780ead4c5acaaf3f2bb4169d0b98fee8ace1c
MD5 0c9597816a57b27795935ba70e5012f6
SHA1 76773734e3744d7f806228aef7e1af3ba9502db2
SHA512 c6a5a99ed7a4003fac3d5cea3bfee239cd6ae5bf50cd605e64f8d7eede3e87216075e0c3e5322e7df8d85e3d68c5e3f21e6d4ad41cbc79e28820b508eabafebc
SSDEEP 1536:Rd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZcl/52izbR9Xwzz:hdseIOMEZEyFjEOFqTiQmOl/5xPvw3
MD5 SHA1 SHA512 SSDEEP

Submit Download