neconyd | a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc.exe
Size 96KB
Sample240807-bwc4qszgrc
SHA256 a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc
MD5 0c2a8c28b3d01fa462e813cd472a7d0e
SHA1 61cc1843f56cf4f4de472011fa479d4a2f2110a5
SHA512 4f14f5ce0a968508287e572978c6cb0561a55c6b5b0c698d97ae6bcd34ef195d625a44bbaead4f60e9fa9317108ad57099342408bbbb944678d5fc09dc8a7702
SSDEEP 1536:JnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:JGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
3168	omsecor.exe
4644	omsecor.exe
816	omsecor.exe
4252	omsecor.exe
1944	omsecor.exe
4832	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4468 set thread context of 4216	4468	a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc.exe	92
PID 3168 set thread context of 4644	3168	omsecor.exe	97
PID 816 set thread context of 4252	816	omsecor.exe	108
PID 1944 set thread context of 4832	1944	omsecor.exe	111

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3548	4468	WerFault.exe	91
3092	3168	WerFault.exe	95
1340	816	WerFault.exe	107
2416	1944	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4216	4468	a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc.exe	92
PID 4468 wrote to memory of 4216	4468	a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc.exe	92
PID 4468 wrote to memory of 4216	4468	a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc.exe	92
PID 4468 wrote to memory of 4216	4468	a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc.exe	92
PID 4468 wrote to memory of 4216	4468	a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc.exe	92
PID 4216 wrote to memory of 3168	4216	a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc.exe	95
PID 4216 wrote to memory of 3168	4216	a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc.exe	95
PID 4216 wrote to memory of 3168	4216	a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc.exe	95
PID 3168 wrote to memory of 4644	3168	omsecor.exe	97
PID 3168 wrote to memory of 4644	3168	omsecor.exe	97
PID 3168 wrote to memory of 4644	3168	omsecor.exe	97
PID 3168 wrote to memory of 4644	3168	omsecor.exe	97
PID 3168 wrote to memory of 4644	3168	omsecor.exe	97
PID 4644 wrote to memory of 816	4644	omsecor.exe	107
PID 4644 wrote to memory of 816	4644	omsecor.exe	107
PID 4644 wrote to memory of 816	4644	omsecor.exe	107
PID 816 wrote to memory of 4252	816	omsecor.exe	108
PID 816 wrote to memory of 4252	816	omsecor.exe	108
PID 816 wrote to memory of 4252	816	omsecor.exe	108
PID 816 wrote to memory of 4252	816	omsecor.exe	108
PID 816 wrote to memory of 4252	816	omsecor.exe	108
PID 4252 wrote to memory of 1944	4252	omsecor.exe	110
PID 4252 wrote to memory of 1944	4252	omsecor.exe	110
PID 4252 wrote to memory of 1944	4252	omsecor.exe	110
PID 1944 wrote to memory of 4832	1944	omsecor.exe	111
PID 1944 wrote to memory of 4832	1944	omsecor.exe	111
PID 1944 wrote to memory of 4832	1944	omsecor.exe	111
PID 1944 wrote to memory of 4832	1944	omsecor.exe	111
PID 1944 wrote to memory of 4832	1944	omsecor.exe	111

C:\Users\Admin\AppData\Local\Temp\a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc.exe
"C:\Users\Admin\AppData\Local\Temp\a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Users\Admin\AppData\Local\Temp\a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc.exe
  C:\Users\Admin\AppData\Local\Temp\a64ea386d40acbc4da6fa8dfe974429a40f9054cc4ae20f89baba0cdf61b03dc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4644
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:816
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 268
        8⤵
        Program crash
        
        PID:2416
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 296
        6⤵
        Program crash
        
        PID:1340
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 288
      4⤵
      Program crash
      PID:3092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 288
  2⤵
  - Program crash
  PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4468 -ip 4468
1⤵
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3168 -ip 3168
1⤵
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4464,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8
1⤵
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 816 -ip 816
1⤵
PID:3092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1944 -ip 1944
1⤵
PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 3eb9f5ed3c47753ffe36db5ef1d82de6ad6ea166b614cbfac95b948233806a56
MD5 4d1e551fc1399847fed5a98fa4166f2c
SHA1 1ef340a96a02de3c3c26a14d4e20414c400e0f76
SHA512 a958fd41b336fe0dcf8aa32db65a0dcc3921524c3a17485a493206ca32e31b299a5dfda297655ea4ceb29c640c82c7948daed6c3734277a152ccd7113b72e9b6
SSDEEP 1536:znAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:zGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 edce371a5a785e8ce4deaa00bc46167c08f00d2f3ce2fd8a54bd0dca854400b0
MD5 ba74b2b36b60ba2ad7540c48e3eec78d
SHA1 546b519cc49baf491296144c45bb3be7c50e6d97
SHA512 fb0a51f110d3b35e7c7c08c89b509268260d634baba04e4986e1bfaecca9ba2f0a87eb3db48292d2fdcd4ec02aaf86faabca72b42b11818aa9ca93c3ca6ee5d6
SSDEEP 1536:NnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:NGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 854fa797cac41e33a283935d20fc8ea6a398b58eae4203b97aeee1882a8b91b0
MD5 489681a3e48808e4bf387bd820be0dab
SHA1 6789d4a185fba3f65f753e8661ee99bb2685e618
SHA512 d4f57fad5798e496337695f2fb8c75841ec156bc306350c1b8daa788f784d0415968164de2c7465e272b52b9035c2e4c5bb0dae89cf82dfa372b0006f7e08395
SSDEEP 1536:znAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:zGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/816-52-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/816-33-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1944-44-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3168-11-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3168-18-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4216-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4216-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4216-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4216-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4252-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4252-39-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4252-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4468-17-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4468-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4644-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4644-29-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4644-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4644-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4644-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4644-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4644-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4832-50-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4832-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4832-54-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4832-57-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads