neconyd | e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8.exe
Size 96KB
Sample240727-ftgflayglr
SHA256 e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8
MD5 cd94490f87d82bf522893515c08c5ca0
SHA1 c66e3a5516da3f50dbb16bfaefdbd2e1691b7921
SHA512 e068cfde0d015d5e8e6889be0dbb424c79059c9144f6e3ceea04e06b683aee8ed9844cce0a12f1ed27fea983270ec3b93e8493339c11967e6d1b0ec808d4b81e
SSDEEP 1536:rnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:rGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
1908	omsecor.exe
5048	omsecor.exe
4524	omsecor.exe
2288	omsecor.exe
2492	omsecor.exe
4468	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1400 set thread context of 1588	1400	e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8.exe	86
PID 1908 set thread context of 5048	1908	omsecor.exe	91
PID 4524 set thread context of 2288	4524	omsecor.exe	108
PID 2492 set thread context of 4468	2492	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1504	1400	WerFault.exe	85
1872	1908	WerFault.exe	89
4460	4524	WerFault.exe	107
1404	2492	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1588	1400	e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8.exe	86
PID 1400 wrote to memory of 1588	1400	e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8.exe	86
PID 1400 wrote to memory of 1588	1400	e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8.exe	86
PID 1400 wrote to memory of 1588	1400	e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8.exe	86
PID 1400 wrote to memory of 1588	1400	e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8.exe	86
PID 1588 wrote to memory of 1908	1588	e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8.exe	89
PID 1588 wrote to memory of 1908	1588	e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8.exe	89
PID 1588 wrote to memory of 1908	1588	e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8.exe	89
PID 1908 wrote to memory of 5048	1908	omsecor.exe	91
PID 1908 wrote to memory of 5048	1908	omsecor.exe	91
PID 1908 wrote to memory of 5048	1908	omsecor.exe	91
PID 1908 wrote to memory of 5048	1908	omsecor.exe	91
PID 1908 wrote to memory of 5048	1908	omsecor.exe	91
PID 5048 wrote to memory of 4524	5048	omsecor.exe	107
PID 5048 wrote to memory of 4524	5048	omsecor.exe	107
PID 5048 wrote to memory of 4524	5048	omsecor.exe	107
PID 4524 wrote to memory of 2288	4524	omsecor.exe	108
PID 4524 wrote to memory of 2288	4524	omsecor.exe	108
PID 4524 wrote to memory of 2288	4524	omsecor.exe	108
PID 4524 wrote to memory of 2288	4524	omsecor.exe	108
PID 4524 wrote to memory of 2288	4524	omsecor.exe	108
PID 2288 wrote to memory of 2492	2288	omsecor.exe	110
PID 2288 wrote to memory of 2492	2288	omsecor.exe	110
PID 2288 wrote to memory of 2492	2288	omsecor.exe	110
PID 2492 wrote to memory of 4468	2492	omsecor.exe	112
PID 2492 wrote to memory of 4468	2492	omsecor.exe	112
PID 2492 wrote to memory of 4468	2492	omsecor.exe	112
PID 2492 wrote to memory of 4468	2492	omsecor.exe	112
PID 2492 wrote to memory of 4468	2492	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8.exe
"C:\Users\Admin\AppData\Local\Temp\e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\AppData\Local\Temp\e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8.exe
  C:\Users\Admin\AppData\Local\Temp\e6add0fb76829e62e47f2821a626062fcf419ef3c93d2a4745a943bcba80ddf8.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1908
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5048
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4524
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2288
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2492
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 224
        8⤵
        Program crash
        
        PID:1404
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 292
        6⤵
        Program crash
        
        PID:4460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 288
      4⤵
      Program crash
      PID:1872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 288
  2⤵
  - Program crash
  PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1400 -ip 1400
1⤵
PID:324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1908 -ip 1908
1⤵
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4524 -ip 4524
1⤵
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2492 -ip 2492
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 03d169fd8133575114fc961a95d85f240ea988596b6f84180890dae94e17458e
MD5 d929ae6c6ff764fd92d20d21fdfab828
SHA1 70e38801640f09337943f08de79a40ba722778bf
SHA512 8eb503d701f339e8da55870006663aef9336bf781def322d9692480bcb2964e7cbd49b7cfd6a7782917d35cb4f3ab075ca44ef0e5dca2a56bd388080667000a4
SSDEEP 1536:4nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:4Gs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 92e1c4b28f4b99a80af9356dba0f8527f623a0b885d81d8a0f62c679e82d45e6
MD5 58025057d6fc879710c85a434f387ee6
SHA1 9642ae0a3347b9a0078417581f644527800edb7b
SHA512 9bf616f2886ee8cedce330057c105b0fb189b2e07733a558d2f2be95c051a24cbbd3144fc937f1ca793f78b9cf880625158b5d80adcd691e16b442b05cd95a27
SSDEEP 1536:znAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:zGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 13fd137d2afe948f8ec2c0882d613fa74899e42c7c1d874f9844c12ba7d5f469
MD5 af6e39526fa61d16d5e0ceedd0114932
SHA1 7e6d1adebac49ea3db3fb6c0c8633d9ba0976420
SHA512 3d803eadc34b3154d28e3f32e9687af78e1f4299ab5d31ce91e159bae7d9cb8d2fdf0b95b47db78d7df6f041f4e825b65084040b7493fad3ebd917e49de6e08d
SSDEEP 1536:InAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:IGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1400-17-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1400-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1588-6-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1588-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1588-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1588-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1908-19-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1908-8-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2288-40-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2288-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2288-38-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2492-54-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2492-45-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4468-57-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4468-55-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4468-51-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4468-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4524-33-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5048-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5048-30-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5048-27-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5048-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5048-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5048-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5048-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads