neconyd | 3a73e9b1c86c2e105c55766540135595d57918a0f1b0aa9cd25b190657e0e1ba

Analysis

max time kernel
116s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2024, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8992e6eb0fd56c721b26387d481c3df0N.exe
Size 71KB
Sample240815-ps8ccs1gnb
SHA256 3a73e9b1c86c2e105c55766540135595d57918a0f1b0aa9cd25b190657e0e1ba
MD5 8992e6eb0fd56c721b26387d481c3df0
SHA1 8d19d834a2b71c5e536712ce0527a49c3b2980b8
SHA512 66437fed911e245ade7156baf778e9779134fa43435c3cd9bcefa17a59244a990f1b60bf9975426a3b83cef9a6b54dc9cd1130ba5033ca809a1f2f2a15233509
SSDEEP 1536:Md9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:0dseIOMEZEyFjEOFqTiQmQDHIbH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
828	omsecor.exe
4868	omsecor.exe
4880	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8992e6eb0fd56c721b26387d481c3df0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 828	556	8992e6eb0fd56c721b26387d481c3df0N.exe	84
PID 556 wrote to memory of 828	556	8992e6eb0fd56c721b26387d481c3df0N.exe	84
PID 556 wrote to memory of 828	556	8992e6eb0fd56c721b26387d481c3df0N.exe	84
PID 828 wrote to memory of 4868	828	omsecor.exe	105
PID 828 wrote to memory of 4868	828	omsecor.exe	105
PID 828 wrote to memory of 4868	828	omsecor.exe	105
PID 4868 wrote to memory of 4880	4868	omsecor.exe	106
PID 4868 wrote to memory of 4880	4868	omsecor.exe	106
PID 4868 wrote to memory of 4880	4868	omsecor.exe	106

C:\Users\Admin\AppData\Local\Temp\8992e6eb0fd56c721b26387d481c3df0N.exe
"C:\Users\Admin\AppData\Local\Temp\8992e6eb0fd56c721b26387d481c3df0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:556
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 71KB
SHA256 01dbc9e2d36bcc852099c82c85bdc99937000ac40a8afda3a6eb1c4c33df6927
MD5 faf87c5146cc57e302b16eb69d84d347
SHA1 3cb8f4bd5a8aad3d13edb69265312db60ffe5276
SHA512 ea9ff6077ff02fe8ec9e0aff3f4af89d73aa11cf54a143e24673b1b4aedfd66919a0ee1d5960ac0137903c2b897a4534ff6f2c98d3be933b6da467ddd29d0316
SSDEEP 1536:od9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:YdseIOMEZEyFjEOFqTiQmQDHIbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 71KB
SHA256 da6b862db670af3667fbd83e5a57438e0186a41ca3aeef5fc8e8269571f9ebad
MD5 e413a512d96370a36188aef9e00e0301
SHA1 48d43cd76b087f0cde4d27f8bbf8c3eaffae0dfd
SHA512 310404879c1f2ad6c4d18ab47b123777ab188290b99b34a255c95a3bc3079bb9d222c9ecf9bf45c95aa4eea6ecdc5ee48f8623fb38380991428f09b5c1e99e8a
SSDEEP 1536:Md9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:0dseIOMEZEyFjEOFqTiQmQDHIbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 71KB
SHA256 1874a816b3118bdb6c8e4ed6d902136ed508de9bebf5ddb2d3bf93974e30f3f4
MD5 4bab35a0fc89b684857d3f93111e8d4a
SHA1 c2a083e8dadfcbaa2cecbf3c17ff823ae00e23bd
SHA512 ec1500067e2e466bbfa0adea7d18390634db893af902cfc2275fd233e074d609082bc4f6f604437cf928b78bb464c0860f08140fc102d46c925870ce5e5bc224
SSDEEP 1536:Yd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:odseIOMEZEyFjEOFqTiQmQDHIbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/556-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/556-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/828-4-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/828-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/828-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4868-11-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4868-17-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4880-18-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4880-20-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads