neconyd | bb0e4d1a71040b8d80aa75a2132f5948bb8a781f099e8f663e57cf3914a91a83

Analysis

max time kernel
114s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
85879ec6488aa123fbeb48b01d885a40N.exe
Size 80KB
Sample240727-dgtjaashmn
SHA256 bb0e4d1a71040b8d80aa75a2132f5948bb8a781f099e8f663e57cf3914a91a83
MD5 85879ec6488aa123fbeb48b01d885a40
SHA1 f377663e9ae54bebe1536e5efbfde7866492fa9c
SHA512 9790e3f73b83ec7651c90e82a77d1c9e8fe5e260c793c7ab69dfe7bd36800b8a7b00a06b5fac1cf14a55485458ef55a6ed9b4b76c3361d1ce12e8acb06985d5c
SSDEEP 1536:0d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZcl/52izbR9Xwzz:MdseIOMEZEyFjEOFqTiQmOl/5xPvw3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4100	omsecor.exe
3924	omsecor.exe
3656	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85879ec6488aa123fbeb48b01d885a40N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 4100	2228	85879ec6488aa123fbeb48b01d885a40N.exe	83
PID 2228 wrote to memory of 4100	2228	85879ec6488aa123fbeb48b01d885a40N.exe	83
PID 2228 wrote to memory of 4100	2228	85879ec6488aa123fbeb48b01d885a40N.exe	83
PID 4100 wrote to memory of 3924	4100	omsecor.exe	99
PID 4100 wrote to memory of 3924	4100	omsecor.exe	99
PID 4100 wrote to memory of 3924	4100	omsecor.exe	99
PID 3924 wrote to memory of 3656	3924	omsecor.exe	100
PID 3924 wrote to memory of 3656	3924	omsecor.exe	100
PID 3924 wrote to memory of 3656	3924	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\85879ec6488aa123fbeb48b01d885a40N.exe
"C:\Users\Admin\AppData\Local\Temp\85879ec6488aa123fbeb48b01d885a40N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3924
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 80KB
SHA256 583888d205471c3d6be17bc1b20a335364dbfc5e67ecc87a2e0247c997ba9d7e
MD5 b89e43a4b15ccaf7637ee5921210193d
SHA1 5eb2b8717be4d8ed3d17e164e72f7b63e4b6fc4a
SHA512 8c5ff312b5aa46baa7c81a9516c19ebe5186079641153ed007c41937f86b059b13ea5eecb177171a81930f18a54ff25e4a971c75e3f25145ddf30a8abff77e42
SSDEEP 1536:od9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZcl/52izbR9Xwzz:YdseIOMEZEyFjEOFqTiQmOl/5xPvw3
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 80KB
SHA256 778560cbe1d07d855ba7ad3c752e2e83cb44cf9f153a8e457afda2a6c4ef8ae7
MD5 f95b14e0bedc9891a0383654898bc861
SHA1 eb0d986ffe64aa71bb1284275d6796200e40de58
SHA512 eaa45438de15ceea876be85121dc06329744cf40658ed43e959cd1e9c2134c3e464479d4bb1a690448ace3180ca5c723dbbe0da658c670c0d1a230db0012c36f
SSDEEP 1536:td9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZcl/52izbR9Xwzz:FdseIOMEZEyFjEOFqTiQmOl/5xPvw3
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 80KB
SHA256 c442fa5f861bc346f35f6636f149815ac6bfc4a4495eb02bc3675293f9d3bbb8
MD5 17c6654d95be68649e61b569c67f8f90
SHA1 1be25ed15b2da73417987f0af0c872986c6838ea
SHA512 b4f1054f4e188ae4793f38ee4492f0e587a6a4e25c0961583156d7efe70dbf0151c92b1e74ca99c72a9b4b778ac74536807c7f6c6f7847edcbda5bef1a9519dc
SSDEEP 1536:Jd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZcl/52izbR9Xwzz:JdseIOMEZEyFjEOFqTiQmOl/5xPvw3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads