neconyd | 26898b3cf1cc52bc6b2db031839641ab43ebad38e50afb7a7ce15e4c1f105cfb

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
26898b3cf1cc52bc6b2db031839641ab43ebad38e50afb7a7ce15e4c1f105cfb.exe
Size 71KB
Sample240808-ybd7masbpg
SHA256 26898b3cf1cc52bc6b2db031839641ab43ebad38e50afb7a7ce15e4c1f105cfb
MD5 aff0802cac47b83b4bbbd866712d0781
SHA1 e63e8b1717bbfedafde9b7b302892353cf98095c
SHA512 03836687d3ca18d080098c923b6560a6a2f6d8d0ace198d47a42399d64b5d83bf8d77b02aa72f864b49c8f92c8f1ccec91dfc0b015eff2b17e1a7e7a43112d13
SSDEEP 1536:Jd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:JdseIOMEZEyFjEOFqTiQmQDHIbH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
400	omsecor.exe
4776	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	26898b3cf1cc52bc6b2db031839641ab43ebad38e50afb7a7ce15e4c1f105cfb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 400	4736	26898b3cf1cc52bc6b2db031839641ab43ebad38e50afb7a7ce15e4c1f105cfb.exe	83
PID 4736 wrote to memory of 400	4736	26898b3cf1cc52bc6b2db031839641ab43ebad38e50afb7a7ce15e4c1f105cfb.exe	83
PID 4736 wrote to memory of 400	4736	26898b3cf1cc52bc6b2db031839641ab43ebad38e50afb7a7ce15e4c1f105cfb.exe	83
PID 400 wrote to memory of 4776	400	omsecor.exe	90
PID 400 wrote to memory of 4776	400	omsecor.exe	90
PID 400 wrote to memory of 4776	400	omsecor.exe	90

C:\Users\Admin\AppData\Local\Temp\26898b3cf1cc52bc6b2db031839641ab43ebad38e50afb7a7ce15e4c1f105cfb.exe
"C:\Users\Admin\AppData\Local\Temp\26898b3cf1cc52bc6b2db031839641ab43ebad38e50afb7a7ce15e4c1f105cfb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 71KB
SHA256 ac0b74347a1a46b811c43760a6bf75695774ef55f191b66893cb545142b42d8c
MD5 8bf5ca10c082da8618a1c0b383799022
SHA1 3abe3c0bb5acba4d08b3cc4720392bb0235e91d1
SHA512 1bcf6ddee84448b2661649d0f7e8f31f0b33c49c342d3fb110cb8c9fd2a6413ceae543769dc083364079d4f64af0c86e1fbe5f555df01a2f5f7c3b1cc04cbb9c
SSDEEP 1536:Zd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:5dseIOMEZEyFjEOFqTiQmQDHIbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 71KB
SHA256 3a73e9b1c86c2e105c55766540135595d57918a0f1b0aa9cd25b190657e0e1ba
MD5 8992e6eb0fd56c721b26387d481c3df0
SHA1 8d19d834a2b71c5e536712ce0527a49c3b2980b8
SHA512 66437fed911e245ade7156baf778e9779134fa43435c3cd9bcefa17a59244a990f1b60bf9975426a3b83cef9a6b54dc9cd1130ba5033ca809a1f2f2a15233509
SSDEEP 1536:Md9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:0dseIOMEZEyFjEOFqTiQmQDHIbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/400-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/400-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4736-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4736-5-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4776-12-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4776-14-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads