neconyd | 4790c99bd84e38b564bf200f379f026eb124f1edb575e01113cce8277c35dc32

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4790c99bd84e38b564bf200f379f026eb124f1edb575e01113cce8277c35dc32.exe
Size 61KB
Sample240801-2tm42avfmc
SHA256 4790c99bd84e38b564bf200f379f026eb124f1edb575e01113cce8277c35dc32
MD5 8d418468ffbcefc9f13321a2a1d4ec37
SHA1 00cdb61f68adfb89fa3c50b487f9bc55f9aab442
SHA512 039bc4bed3085297dff2845d994c400710c62b5f3adcc03e41fb43047485da5c994a47566f666d782f3f0fd89abe1320822225a9c134066bc0481e1294809b09
SSDEEP 1536:+d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZpl/5:mdseIOMEZEyFjEOFqTiQmDl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4780	omsecor.exe
3896	omsecor.exe
4932	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4790c99bd84e38b564bf200f379f026eb124f1edb575e01113cce8277c35dc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4780	4588	4790c99bd84e38b564bf200f379f026eb124f1edb575e01113cce8277c35dc32.exe	82
PID 4588 wrote to memory of 4780	4588	4790c99bd84e38b564bf200f379f026eb124f1edb575e01113cce8277c35dc32.exe	82
PID 4588 wrote to memory of 4780	4588	4790c99bd84e38b564bf200f379f026eb124f1edb575e01113cce8277c35dc32.exe	82
PID 4780 wrote to memory of 3896	4780	omsecor.exe	89
PID 4780 wrote to memory of 3896	4780	omsecor.exe	89
PID 4780 wrote to memory of 3896	4780	omsecor.exe	89
PID 3896 wrote to memory of 4932	3896	omsecor.exe	90
PID 3896 wrote to memory of 4932	3896	omsecor.exe	90
PID 3896 wrote to memory of 4932	3896	omsecor.exe	90

C:\Users\Admin\AppData\Local\Temp\4790c99bd84e38b564bf200f379f026eb124f1edb575e01113cce8277c35dc32.exe
"C:\Users\Admin\AppData\Local\Temp\4790c99bd84e38b564bf200f379f026eb124f1edb575e01113cce8277c35dc32.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 02ea8e2f50045a28be3ac6c322d1aac9e59bc82fec3e1e1f1e0ef8529c40a57e
MD5 87e0de9fe855c216addb42eefebebfc4
SHA1 743304b6fc9b2ca592219a7a10c9e25a6f318077
SHA512 4a22b0737de752fa40f09027de0090f6bea537447b9727593a883be15d1351b561c85129562dc2855a111da786b389499cdf78754f1efaea8cd238c0bbfbeb10
SSDEEP 1536:2d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZpl/5:OdseIOMEZEyFjEOFqTiQmDl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 61KB
SHA256 8ef8d406daa3677e9dd7b1da54acfa57223252f7af96bfd892d671aa408a6097
MD5 70fc66ed33b93d4fc1eb3b6096c3cb1b
SHA1 5b2cd12fb406f669e3588fecdc5404b8cf05e722
SHA512 7c3aa61be4c8ea9b93ac2cea95fe2722365d9f9469e5847ae8de17d69bffc5248aa850c1aa0aabe8988c72bae839ddc3b69a2e2b7762a22cdaee1a5a8b6d3c8b
SSDEEP 1536:ad9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZpl/5:6dseIOMEZEyFjEOFqTiQmDl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 61KB
SHA256 405155c81196092f1a12d4a460d1d6b302f57053bf10c682e89b942b2359da68
MD5 cac95950b2ccd2fa22114931a469e635
SHA1 453dd7c97a9b6a5226d8e39e25f35571ed9d1b89
SHA512 023aa5709b6012fe6804a165a8c8034ae0d4f511c4bbffa41e52d8141e0fb7b08b071d18f00f582a7080afc7b80841e99f79c61d715dc851706673e3978e1567
SSDEEP 1536:yd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZpl/5:CdseIOMEZEyFjEOFqTiQmDl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads