neconyd | 61ed71ad36a8c1cb22c238c0acc96e1380c955ba90488c31a830b221b9dff308

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
61ed71ad36a8c1cb22c238c0acc96e1380c955ba90488c31a830b221b9dff308.exe
Size 88KB
Sample240803-2lpynasdmc
SHA256 61ed71ad36a8c1cb22c238c0acc96e1380c955ba90488c31a830b221b9dff308
MD5 20fa9b090db60ba298caffb5b9967db3
SHA1 2a6c512fb256ad6a985cd7e2e91f360885a5d761
SHA512 e0c9683fcca194c2dbdd8dc2c0c04834238a2f62b0c79d137b3b754b22e32143c3d955a67339242e9c6bc70a50c011db54f022fefd6516cab42fff737a6f3f5d
SSDEEP 1536:Jd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:JdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
3444	omsecor.exe
1660	omsecor.exe
3308	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	61ed71ad36a8c1cb22c238c0acc96e1380c955ba90488c31a830b221b9dff308.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 3444	1436	61ed71ad36a8c1cb22c238c0acc96e1380c955ba90488c31a830b221b9dff308.exe	83
PID 1436 wrote to memory of 3444	1436	61ed71ad36a8c1cb22c238c0acc96e1380c955ba90488c31a830b221b9dff308.exe	83
PID 1436 wrote to memory of 3444	1436	61ed71ad36a8c1cb22c238c0acc96e1380c955ba90488c31a830b221b9dff308.exe	83
PID 3444 wrote to memory of 1660	3444	omsecor.exe	90
PID 3444 wrote to memory of 1660	3444	omsecor.exe	90
PID 3444 wrote to memory of 1660	3444	omsecor.exe	90
PID 1660 wrote to memory of 3308	1660	omsecor.exe	91
PID 1660 wrote to memory of 3308	1660	omsecor.exe	91
PID 1660 wrote to memory of 3308	1660	omsecor.exe	91

C:\Users\Admin\AppData\Local\Temp\61ed71ad36a8c1cb22c238c0acc96e1380c955ba90488c31a830b221b9dff308.exe
"C:\Users\Admin\AppData\Local\Temp\61ed71ad36a8c1cb22c238c0acc96e1380c955ba90488c31a830b221b9dff308.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 2b39cea821cba12c52b0b4b15d89fcbe09543163474b2d4f4610e30658e3ef1c
MD5 1c694aa34c7ece3f839afdfdd9eb0a41
SHA1 0325369d7aeacebc9b339dee76b6f7e370e556d3
SHA512 b733a5f12472a255d3c2af1f32d52e7d54a3c0fed2232bde2751e465c14660e999a369a189d043466b02a8a17489e19599f046288b2aa2c20fae4fd47d2cc147
SSDEEP 1536:Zd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:5dseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 88KB
SHA256 a8fd1f20819663f23377dc9a0ebb836f3ea42f8ac0721e0af124ca9e5927724f
MD5 807714e3ec7cb1a8dde8581241e8e596
SHA1 f992bb85e6055c595fb04fbf582827f92b45b949
SHA512 aa4e6ac2115dd08989f1eb78d19536d8b7a6c01dfa758eb457c3b039af45be0cbcdc512adf12396c0b6e63d873c0e1b0fd74f34d813e467fcdb3a66d40aca7f7
SSDEEP 1536:Vd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:ddseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 88KB
SHA256 28cd66aa074b3e02052b1ec7655d6754cd662080eee7af620291077d362ea442
MD5 6ba703c0449c3d06152f5bcf67f5b375
SHA1 0f96b66e619e4de3d300bf511f8fbdb9aec4d9ff
SHA512 0c787a160174f513a6c869d381848ad89a4eff020f5390cbc4e15cad8ccb5b1a88819f0c1f612ae13432a2b6e00ed859fb68a4797d312bd1afdc48a91d65f76e
SSDEEP 1536:td9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:FdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads