neconyd | a5722cd14bd1022761eec153fcbbbc3587c6f6d6c927855b92cee6f5db382e03

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5722cd14bd1022761eec153fcbbbc3587c6f6d6c927855b92cee6f5db382e03.exe
Size 33KB
Sample240803-bj5cfssdmh
SHA256 a5722cd14bd1022761eec153fcbbbc3587c6f6d6c927855b92cee6f5db382e03
MD5 de1a5920bcd8344d551d5238edfd9d17
SHA1 cbab8f2117c76bbfb5393bda146d3ec7491ca19c
SHA512 b13d03512d8098ed2c8b6d2234a2e200c959a518c156a1df3e85c0dad4faaf1dba4756ba68e23a05f22538c6b1e8936e84160dea201ca224d7e00e0e0e814e17
SSDEEP 768:gfVhP/4kt3+9IV6Y90ksQ1oWHT0hh0vy9S5fsYGbTmoN/yE56hlSQ7D:gfVRztyHo8QNHTk0qE5fslvN/956q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
3520	omsecor.exe
4344	omsecor.exe
4348	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a5722cd14bd1022761eec153fcbbbc3587c6f6d6c927855b92cee6f5db382e03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 3520	2552	a5722cd14bd1022761eec153fcbbbc3587c6f6d6c927855b92cee6f5db382e03.exe	83
PID 2552 wrote to memory of 3520	2552	a5722cd14bd1022761eec153fcbbbc3587c6f6d6c927855b92cee6f5db382e03.exe	83
PID 2552 wrote to memory of 3520	2552	a5722cd14bd1022761eec153fcbbbc3587c6f6d6c927855b92cee6f5db382e03.exe	83
PID 3520 wrote to memory of 4344	3520	omsecor.exe	86
PID 3520 wrote to memory of 4344	3520	omsecor.exe	86
PID 3520 wrote to memory of 4344	3520	omsecor.exe	86
PID 4344 wrote to memory of 4348	4344	omsecor.exe	87
PID 4344 wrote to memory of 4348	4344	omsecor.exe	87
PID 4344 wrote to memory of 4348	4344	omsecor.exe	87

C:\Users\Admin\AppData\Local\Temp\a5722cd14bd1022761eec153fcbbbc3587c6f6d6c927855b92cee6f5db382e03.exe
"C:\Users\Admin\AppData\Local\Temp\a5722cd14bd1022761eec153fcbbbc3587c6f6d6c927855b92cee6f5db382e03.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 33KB
SHA256 ced69cfe5f106b6b5d60ce94e458560f7225d3e79e557f03196c4aa011366c44
MD5 c48cd3fb7cc79ffc4f1b551428ba07e7
SHA1 125c4fd26b37ffdd9eff6ad8824e9e1559d4eb81
SHA512 5a884af6662479b0e76b982286397251b7b6ca55fd0b5ff2e11e08fdd7bab5791c1ed8eac43fabdaa2825f5d52cdd044f6fd653652108c08568863aaec89b29e
SSDEEP 768:2fVhP/4kt3+9IV6Y90ksQ1oWHT0hh0vy9S5fsYGbTmoN/yE56hlSQ7D:2fVRztyHo8QNHTk0qE5fslvN/956q
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 33KB
SHA256 3f63dbbceeba7490ece7fed7429a8af277ffff34e49db5b6afe0d7a07f382538
MD5 350e033139e73d28de89f51cc0916bc5
SHA1 ced9a9a58fabd14754eb18787cfe0d0f25884c2c
SHA512 f5c5b3d0db27305c5120b9df66ee70f9f656746b2852893b2721246dc02098cf9c838b73a0425d5429fde351dae7349792a33510bdc300b0601f98580e201e86
SSDEEP 768:AfVhP/4kt3+9IV6Y90ksQ1oWHT0hh0vy9S5fsYGbTmoN/yE56hlSQ7D:AfVRztyHo8QNHTk0qE5fslvN/956q
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 33KB
SHA256 99e0fcfb56eba6f6cdb1890b97e598c9ac30ff7751badbd2fec842576b2a70d0
MD5 fffc01c8d6190698fd06530685b2f1bc
SHA1 4f7d05413500ede48f47bfe29f02f8bcabc03fe1
SHA512 624411b92c45d352185a40e304fb50f68bcdc024b7b6579d42e8e1ba27ae277916146e4cce22a2d8ccb37ec88e8188c6890f2fdf32fd215d63acbfa741328165
SSDEEP 768:ffVhP/4kt3+9IV6Y90ksQ1oWHT0hh0vy9S5fsYGbTmoN/yE56hlSQ7D:ffVRztyHo8QNHTk0qE5fslvN/956q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2552-6-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2552-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3520-8-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3520-14-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3520-15-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3520-11-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3520-20-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3520-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4344-21-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4344-26-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4348-27-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4348-29-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4348-32-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4348-34-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads