neconyd | 6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672.exe
Size 134KB
Sample240802-2vrhvaycqa
SHA256 6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672
MD5 5e2cbe415091d75a2377cf0a755798ce
SHA1 c62775dc7cbf05f4febec16d9896205b2baf94d3
SHA512 438133883bf3db1bbac7c0d3089103c22493640796c50ff2a3a67cb3ad93a40b8eb210ff43fd0f465b0807c69b12dd49659b07dfbcb6157fb2d8c9c1edc16601
SSDEEP 1536:xDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:RiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
4264	omsecor.exe
1148	omsecor.exe
4328	omsecor.exe
3948	omsecor.exe
3960	omsecor.exe
1760	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4700 set thread context of 2448	4700	6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672.exe	82
PID 4264 set thread context of 1148	4264	omsecor.exe	86
PID 4328 set thread context of 3948	4328	omsecor.exe	95
PID 3960 set thread context of 1760	3960	omsecor.exe	99

Program crash 4 IoCs

pid	pid_target	Process	procid_target
712	4700	WerFault.exe	80
4460	4264	WerFault.exe	85
4408	4328	WerFault.exe	94
2144	3960	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 2448	4700	6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672.exe	82
PID 4700 wrote to memory of 2448	4700	6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672.exe	82
PID 4700 wrote to memory of 2448	4700	6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672.exe	82
PID 4700 wrote to memory of 2448	4700	6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672.exe	82
PID 4700 wrote to memory of 2448	4700	6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672.exe	82
PID 2448 wrote to memory of 4264	2448	6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672.exe	85
PID 2448 wrote to memory of 4264	2448	6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672.exe	85
PID 2448 wrote to memory of 4264	2448	6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672.exe	85
PID 4264 wrote to memory of 1148	4264	omsecor.exe	86
PID 4264 wrote to memory of 1148	4264	omsecor.exe	86
PID 4264 wrote to memory of 1148	4264	omsecor.exe	86
PID 4264 wrote to memory of 1148	4264	omsecor.exe	86
PID 4264 wrote to memory of 1148	4264	omsecor.exe	86
PID 1148 wrote to memory of 4328	1148	omsecor.exe	94
PID 1148 wrote to memory of 4328	1148	omsecor.exe	94
PID 1148 wrote to memory of 4328	1148	omsecor.exe	94
PID 4328 wrote to memory of 3948	4328	omsecor.exe	95
PID 4328 wrote to memory of 3948	4328	omsecor.exe	95
PID 4328 wrote to memory of 3948	4328	omsecor.exe	95
PID 4328 wrote to memory of 3948	4328	omsecor.exe	95
PID 4328 wrote to memory of 3948	4328	omsecor.exe	95
PID 3948 wrote to memory of 3960	3948	omsecor.exe	97
PID 3948 wrote to memory of 3960	3948	omsecor.exe	97
PID 3948 wrote to memory of 3960	3948	omsecor.exe	97
PID 3960 wrote to memory of 1760	3960	omsecor.exe	99
PID 3960 wrote to memory of 1760	3960	omsecor.exe	99
PID 3960 wrote to memory of 1760	3960	omsecor.exe	99
PID 3960 wrote to memory of 1760	3960	omsecor.exe	99
PID 3960 wrote to memory of 1760	3960	omsecor.exe	99

C:\Users\Admin\AppData\Local\Temp\6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672.exe
"C:\Users\Admin\AppData\Local\Temp\6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Users\Admin\AppData\Local\Temp\6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672.exe
  C:\Users\Admin\AppData\Local\Temp\6e432ad67f92bdab59ee49b5a59b23ecf36f87ced702361906a7b5bc23731672.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1148
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4328
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3948
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 264
        8⤵
        Program crash
        
        PID:2144
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 292
        6⤵
        Program crash
        
        PID:4408
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 300
      4⤵
      Program crash
      PID:4460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 288
  2⤵
  - Program crash
  PID:712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4700 -ip 4700
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4264 -ip 4264
1⤵
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4328 -ip 4328
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3960 -ip 3960
1⤵
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 b1789cb87ea2214346d4a9d54ab55d3fe37eeed5007e229917ab0b9a354c73a3
MD5 6d07451d0e25b61b776b8382bdbf4c09
SHA1 b59c14f671223c89465484beb2f5b8b0e09b34b7
SHA512 471325b9576dd1c55af0a3c062b12115ff589acd7110796122342472780d916da835fa56c792312f50797e0457fd46c8f69398b75abfeb4dc52e8b342e8e1875
SSDEEP 1536:UDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:qiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 134KB
SHA256 7ed25c0bacacae76ca8ae43b0c07f73e74b4e2a7fc0498ef923411363970fcb5
MD5 30ab6a12c447870109ff6f94e8c5edde
SHA1 3b60101a5d2ce861b5575f13ec869310b2b7ac1b
SHA512 5c2ca9f0ce6c21c3a6d05fe2526de4eca3affbedd44a0421636bf91f320d0af9737b7f98e4a15f54230bced2f0deb3d67bc2e83c996d827a4ce02faf0e41b4bd
SSDEEP 1536:ZDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:JiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 134KB
SHA256 a102b752717ea4d568e006123ea346563344e0249fdc5dcb9524725e327a497b
MD5 d367da667a0ba01110950e65e3a8c67d
SHA1 25c20d076e758dbf3c374ce549b46aabef37d64f
SHA512 24ae3a337e4b42db736792d2f35d8f7445e12511334e951957cd89933ec0683a67df6bce4d51500a8b5d843b4730f3a2aade4c58babe1c340611ccd1c21ba134
SSDEEP 1536:EDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:aiRTeH0iqAW6J6f1tqF6dngNmaZCia
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1148-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1148-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1148-30-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1148-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1148-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1148-16-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1148-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1760-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1760-52-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1760-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1760-55-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2448-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2448-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2448-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2448-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3948-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3948-39-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3948-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3960-44-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3960-51-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4264-17-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4264-9-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4328-33-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4328-50-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4700-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4700-18-0x0000000000400000-0x0000000000424000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads