neconyd | 014aafbad68c6c42e3b43b4b9ce13b29bf3d7c283deb0d90261759339ae968d4

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5e562c364451c6c497a94f1f2fd24950N.exe
Size 96KB
Sample240801-k2aegasgpp
SHA256 014aafbad68c6c42e3b43b4b9ce13b29bf3d7c283deb0d90261759339ae968d4
MD5 5e562c364451c6c497a94f1f2fd24950
SHA1 15eae2c7b2ef5ae62ce98bb7312dd53dfb8844a7
SHA512 00cff3f1b6ce8f8e43202b71abc2983b0aad3652ecfcd859db69b087ba1b9e0a5e0462c76aeb3d7e210f5210ba0f8b1308b17320a4f32af90cc6995d402a9e9d
SSDEEP 1536:1nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:1Gs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
4644	omsecor.exe
4948	omsecor.exe
4724	omsecor.exe
4376	omsecor.exe
2196	omsecor.exe
3044	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3668 set thread context of 3344	3668	5e562c364451c6c497a94f1f2fd24950N.exe	83
PID 4644 set thread context of 4948	4644	omsecor.exe	89
PID 4724 set thread context of 4376	4724	omsecor.exe	98
PID 2196 set thread context of 3044	2196	omsecor.exe	101

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3560	3668	WerFault.exe	82
2704	4644	WerFault.exe	86
1044	4724	WerFault.exe	97
4468	2196	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5e562c364451c6c497a94f1f2fd24950N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5e562c364451c6c497a94f1f2fd24950N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 3344	3668	5e562c364451c6c497a94f1f2fd24950N.exe	83
PID 3668 wrote to memory of 3344	3668	5e562c364451c6c497a94f1f2fd24950N.exe	83
PID 3668 wrote to memory of 3344	3668	5e562c364451c6c497a94f1f2fd24950N.exe	83
PID 3668 wrote to memory of 3344	3668	5e562c364451c6c497a94f1f2fd24950N.exe	83
PID 3668 wrote to memory of 3344	3668	5e562c364451c6c497a94f1f2fd24950N.exe	83
PID 3344 wrote to memory of 4644	3344	5e562c364451c6c497a94f1f2fd24950N.exe	86
PID 3344 wrote to memory of 4644	3344	5e562c364451c6c497a94f1f2fd24950N.exe	86
PID 3344 wrote to memory of 4644	3344	5e562c364451c6c497a94f1f2fd24950N.exe	86
PID 4644 wrote to memory of 4948	4644	omsecor.exe	89
PID 4644 wrote to memory of 4948	4644	omsecor.exe	89
PID 4644 wrote to memory of 4948	4644	omsecor.exe	89
PID 4644 wrote to memory of 4948	4644	omsecor.exe	89
PID 4644 wrote to memory of 4948	4644	omsecor.exe	89
PID 4948 wrote to memory of 4724	4948	omsecor.exe	97
PID 4948 wrote to memory of 4724	4948	omsecor.exe	97
PID 4948 wrote to memory of 4724	4948	omsecor.exe	97
PID 4724 wrote to memory of 4376	4724	omsecor.exe	98
PID 4724 wrote to memory of 4376	4724	omsecor.exe	98
PID 4724 wrote to memory of 4376	4724	omsecor.exe	98
PID 4724 wrote to memory of 4376	4724	omsecor.exe	98
PID 4724 wrote to memory of 4376	4724	omsecor.exe	98
PID 4376 wrote to memory of 2196	4376	omsecor.exe	100
PID 4376 wrote to memory of 2196	4376	omsecor.exe	100
PID 4376 wrote to memory of 2196	4376	omsecor.exe	100
PID 2196 wrote to memory of 3044	2196	omsecor.exe	101
PID 2196 wrote to memory of 3044	2196	omsecor.exe	101
PID 2196 wrote to memory of 3044	2196	omsecor.exe	101
PID 2196 wrote to memory of 3044	2196	omsecor.exe	101
PID 2196 wrote to memory of 3044	2196	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\5e562c364451c6c497a94f1f2fd24950N.exe
"C:\Users\Admin\AppData\Local\Temp\5e562c364451c6c497a94f1f2fd24950N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Users\Admin\AppData\Local\Temp\5e562c364451c6c497a94f1f2fd24950N.exe
  C:\Users\Admin\AppData\Local\Temp\5e562c364451c6c497a94f1f2fd24950N.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4948
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4724
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 268
        8⤵
        Program crash
        
        PID:4468
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 292
        6⤵
        Program crash
        
        PID:1044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 300
      4⤵
      Program crash
      PID:2704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 304
  2⤵
  - Program crash
  PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3668 -ip 3668
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4644 -ip 4644
1⤵
PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4724 -ip 4724
1⤵
PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2196 -ip 2196
1⤵
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 82359ebb21f765b0f1a2780e1886deabfb7736bf43462dfadc126eedcd4c0e66
MD5 f58a8c3052ff415185a3984bf3906451
SHA1 c661d03dce49f6847ada21611a626d4e7398d925
SHA512 0bd4e423301791f15adf52d834e8deebccd893866a76d5ddd534ef4e5cabfeddfab345fb1dfc9a6b979750fa1825252bf35e0ce624bfe352c3e47a1d2d97775d
SSDEEP 1536:mnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:mGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 990ea6598a1faa03961f67f0241da2a3b09e862b7df6994784978700e065805f
MD5 27de02363a481732118faf10bc25be12
SHA1 fe74b68942c30e52ad9d538d5782be661253c9b8
SHA512 1153785f5cecbd71c60714d5ac82b5f2d64262f19b223677f2cb2b7d6842763caa06224997202ca2108fb9e81c04373c85f0e6f24d1026cf069e3fa242327482
SSDEEP 1536:qnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:qGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 53f284f5971a0f5f6cd0f82eb0157c41bbac62aa5df79b27ae9958c371c864d3
MD5 6425904c62190c29f393d6c047b850f0
SHA1 f79469f9f3c3f98928d00f5231ffbef2598e4daa
SHA512 d63dff910dde692e8d271da5ae94ac18f62f88a2bb5f2d30a75ff9835f9b890abaebd49328aa1e0abc4eaf6a4337a9ea25a59ed13a70c581f55f055821a6bd8d
SSDEEP 1536:mnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:mGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2196-46-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3044-55-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3044-50-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3044-51-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3344-6-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3344-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3344-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3344-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3668-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3668-18-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4376-38-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4376-39-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4376-44-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4644-10-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4644-20-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4724-35-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4724-53-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4948-32-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4948-28-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4948-27-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4948-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4948-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4948-16-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4948-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads