neconyd | d32ea4b1ec5f6fa811c9e7c7c44d9aa8a43f4fb6957527666f3a883cb3daa183

Analysis

max time kernel
114s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2024, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
702f64b2944e6772217ecad99c7e2620N.exe
Size 92KB
Sample240816-g6basazdph
SHA256 d32ea4b1ec5f6fa811c9e7c7c44d9aa8a43f4fb6957527666f3a883cb3daa183
MD5 702f64b2944e6772217ecad99c7e2620
SHA1 b7c3e8f4b6091e28898c7aca15bef9bfda8a0528
SHA512 54739f79f98a8bd3545e513c637fe96485d609d7a4babd08e9b5451ea5bc3d5580846d952266a807befa40b7e4fdd44395ea0bbb3808a5a24105e3d325fdd47a
SSDEEP 1536:Qd9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5:QdseIOyEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
952	omsecor.exe
4188	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	702f64b2944e6772217ecad99c7e2620N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 952	820	702f64b2944e6772217ecad99c7e2620N.exe	85
PID 820 wrote to memory of 952	820	702f64b2944e6772217ecad99c7e2620N.exe	85
PID 820 wrote to memory of 952	820	702f64b2944e6772217ecad99c7e2620N.exe	85
PID 952 wrote to memory of 4188	952	omsecor.exe	100
PID 952 wrote to memory of 4188	952	omsecor.exe	100
PID 952 wrote to memory of 4188	952	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\702f64b2944e6772217ecad99c7e2620N.exe
"C:\Users\Admin\AppData\Local\Temp\702f64b2944e6772217ecad99c7e2620N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:820
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:4188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 92KB
SHA256 75ae4e628079d8d6b0f0e794cdf2b45b34df8475d577471b34dc4f5f8d58ee79
MD5 f4687189f482d8738954cb13a78ea2be
SHA1 715a630665e477b8ae6dd482652db5f50fd5f838
SHA512 dbec314684583937fba980fca4b2ea79d15c4b5829ab92e24d8e4527cfc9f6b2f1e6b61cbe392930ae560e1f8e60a5258e2bd3f91837a3ec60ad3eebaf65acfc
SSDEEP 1536:8d9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5:EdseIOyEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 92KB
SHA256 58581195b1bdcef88624aa5730ea93a28287340373dc157c5e384cc31bea1f84
MD5 b46ef87b3cf0cb9c54cf5a77123659b0
SHA1 a0e399ff1dd41060112bd537daec04b435668c28
SHA512 9ebe61687216fd672823be8986e35345affd28cbdf57f1a62819f056ee7ad85d6b165080fe0f0fb4e1b94646c194306d2e654b4c9d51fb50a08b98088a30603f
SSDEEP 1536:Dd9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5:jdseIOyEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/820-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/820-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/952-4-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/952-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/952-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4188-12-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4188-14-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads