neconyd | 275a0c5de7ee363d230c506932c586a722b42cad45a4804f935687f2f80f16be

Analysis

max time kernel
129s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
275a0c5de7ee363d230c506932c586a722b42cad45a4804f935687f2f80f16be.exe
Size 92KB
Sample240802-yc3llsscpf
SHA256 275a0c5de7ee363d230c506932c586a722b42cad45a4804f935687f2f80f16be
MD5 f18e4a8c7ff1c5a161262773517acf77
SHA1 2e169af441acf2ca537a08591478c4b4e0fbdc98
SHA512 738a8747bc08c7873c5f0548c5d782f05754c8f05392748549bea2bb2ef97dbbfe76b58eb79d2ed5265c0efbaca10ef0dcb27a4c64259fec91c58ef91162c481
SSDEEP 1536:Od9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5:WdseIOyEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
828	omsecor.exe
920	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	275a0c5de7ee363d230c506932c586a722b42cad45a4804f935687f2f80f16be.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 828	1036	275a0c5de7ee363d230c506932c586a722b42cad45a4804f935687f2f80f16be.exe	82
PID 1036 wrote to memory of 828	1036	275a0c5de7ee363d230c506932c586a722b42cad45a4804f935687f2f80f16be.exe	82
PID 1036 wrote to memory of 828	1036	275a0c5de7ee363d230c506932c586a722b42cad45a4804f935687f2f80f16be.exe	82
PID 828 wrote to memory of 920	828	omsecor.exe	86
PID 828 wrote to memory of 920	828	omsecor.exe	86
PID 828 wrote to memory of 920	828	omsecor.exe	86

C:\Users\Admin\AppData\Local\Temp\275a0c5de7ee363d230c506932c586a722b42cad45a4804f935687f2f80f16be.exe
"C:\Users\Admin\AppData\Local\Temp\275a0c5de7ee363d230c506932c586a722b42cad45a4804f935687f2f80f16be.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 e45e7a16d31f40b37958db5916eddd0d4b80c28d7e2a6dcd2637fbcfbe001f90
MD5 ec6556cd3761dec81e0aaff91fa33375
SHA1 12f136f7b6e810b162b2afb3085972f2e71b3006
SHA512 6b2699680c6d945c4dced2303095b4c8f4416261d842f4a8e291becb9d3296126c5c42ae716cb3ca88f8f643cc7e34b1bb7c37c2a0a9c95e82c09ded926492df
SSDEEP 1536:+d9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5:mdseIOyEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 92KB
SHA256 7419f58ab39c3749a8423ad29ec5b2c0397052587e4fa840d91a643c298fb9eb
MD5 5c47f5a2b2377b9fa7078888cb0d469f
SHA1 b6fb7a0d5c1df805e286940aefb5f51b9ea40003
SHA512 da3e9876b0736501c778fd78722bfcdfb853f36dbc20c08b7978a215daa1efbed10433cd609c33c9e6b5386ff4793d4b3969be9a664148602bbc51bbf3ac6a28
SSDEEP 1536:Sd9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5:idseIOyEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/828-5-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/828-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/828-12-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/920-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/920-14-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1036-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1036-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads