neconyd | 0c9db919a9bfdbfb95af23c34ba53c52658569c1e672dfaa66e528645e347d10

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0c9db919a9bfdbfb95af23c34ba53c52658569c1e672dfaa66e528645e347d10.exe
Size 35KB
Sample240801-xerrfsxhja
SHA256 0c9db919a9bfdbfb95af23c34ba53c52658569c1e672dfaa66e528645e347d10
MD5 a06f3b03bb5a0775effd243c144a5a99
SHA1 525201d49ecd2a29efaf973d2aede3bfd518fd75
SHA512 6bb71856904d76fe5c88002b6110310962b5cb885e39fe95e87c55a56582e85e0d102b94ba154068186f6cf7d810cbeee4cab19d7f515f36c6796464f97a3f09
SSDEEP 768:x6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:88Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
388	omsecor.exe
4828	omsecor.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1404-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x00090000000232e3-3.dat	upx
behavioral2/memory/1404-7-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/388-4-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/388-8-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/388-11-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/388-14-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/388-15-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x000a00000001e7e4-18.dat	upx
behavioral2/memory/388-21-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4828-22-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4828-23-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4828-26-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c9db919a9bfdbfb95af23c34ba53c52658569c1e672dfaa66e528645e347d10.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 388	1404	0c9db919a9bfdbfb95af23c34ba53c52658569c1e672dfaa66e528645e347d10.exe	83
PID 1404 wrote to memory of 388	1404	0c9db919a9bfdbfb95af23c34ba53c52658569c1e672dfaa66e528645e347d10.exe	83
PID 1404 wrote to memory of 388	1404	0c9db919a9bfdbfb95af23c34ba53c52658569c1e672dfaa66e528645e347d10.exe	83
PID 388 wrote to memory of 4828	388	omsecor.exe	90
PID 388 wrote to memory of 4828	388	omsecor.exe	90
PID 388 wrote to memory of 4828	388	omsecor.exe	90

C:\Users\Admin\AppData\Local\Temp\0c9db919a9bfdbfb95af23c34ba53c52658569c1e672dfaa66e528645e347d10.exe
"C:\Users\Admin\AppData\Local\Temp\0c9db919a9bfdbfb95af23c34ba53c52658569c1e672dfaa66e528645e347d10.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 2dcd53a7c40f4a76df90394823f81e7b25f1e1adb4c567c33a91173f30e8c535
MD5 fe132cf4b6f7a5416c0436be113a27cc
SHA1 cf56cbf63c5fc2f6b88098b858679cc0c15bc528
SHA512 45c45ea23f6e8f0032e4894dd0a730e77c897ed4aeece113a1286ae187bf0a0d1c46eb662b1f3f50d314fab8c8fee441fd3967001397553b9354effd97412670
SSDEEP 768:N6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:A8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 35KB
SHA256 2b0b22b36d0e5c2895ee4a79c91df7626d621e3af26ee1f9564534a84bfe893f
MD5 277a53f905baf1609fce04a41272c311
SHA1 3a9bebfe21cfdb07d22a63a5e7a33652dbcc2b41
SHA512 fec2b599bf938d5d57d032cbe3ae66b995b2793a0ec8da2749d2d0ad92322f7dbbd6d8846ce2cff596df1c08f9980f220bf38119de0baa62bdaa2fd36f59d1e9
SSDEEP 768:k6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:z8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-14-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/388-4-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/388-8-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/388-11-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/388-15-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/388-21-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1404-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1404-7-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4828-22-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4828-23-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4828-26-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads