neconyd | a78e3d341536b8ab1540131dbb51643c7681681333ca5f6e4d352b7b2597ba0f

Analysis

max time kernel
117s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2024, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
43d347556cc54861e67143c0b0837b60N.exe
Size 35KB
Sample240816-h2ryeasakd
SHA256 a78e3d341536b8ab1540131dbb51643c7681681333ca5f6e4d352b7b2597ba0f
MD5 43d347556cc54861e67143c0b0837b60
SHA1 a1c62a92affc66d65fa34c94d5419cb06dedb8ad
SHA512 9c934ff623a33168b896f46afdd584c92db9746a83770bc0a0cc4b921bf0a8655ad1c57d9f7c398751bf8c8bb9022e41cf08f1e1dcc5553dd7986db71dee5186
SSDEEP 768:k6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:z8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4976	omsecor.exe
3808	omsecor.exe
3876	omsecor.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4488-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x00080000000236a0-3.dat	upx
behavioral2/memory/4976-4-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4488-5-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4976-7-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4976-10-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4976-13-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4976-14-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x00090000000236b9-17.dat	upx
behavioral2/memory/4976-18-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/3808-19-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/3876-26-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x00080000000236a0-25.dat	upx
behavioral2/memory/3808-24-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/3876-28-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	43d347556cc54861e67143c0b0837b60N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 4976	4488	43d347556cc54861e67143c0b0837b60N.exe	91
PID 4488 wrote to memory of 4976	4488	43d347556cc54861e67143c0b0837b60N.exe	91
PID 4488 wrote to memory of 4976	4488	43d347556cc54861e67143c0b0837b60N.exe	91
PID 4976 wrote to memory of 3808	4976	omsecor.exe	107
PID 4976 wrote to memory of 3808	4976	omsecor.exe	107
PID 4976 wrote to memory of 3808	4976	omsecor.exe	107
PID 3808 wrote to memory of 3876	3808	omsecor.exe	108
PID 3808 wrote to memory of 3876	3808	omsecor.exe	108
PID 3808 wrote to memory of 3876	3808	omsecor.exe	108

C:\Users\Admin\AppData\Local\Temp\43d347556cc54861e67143c0b0837b60N.exe
"C:\Users\Admin\AppData\Local\Temp\43d347556cc54861e67143c0b0837b60N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4148,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
1⤵
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 547b729794b1fab6ae0e51f7cd55565f327a5e865038ac7dfbb60f51f6f4365f
MD5 356c7aacfc473ac4e97c300d153f1c29
SHA1 57ddc6859f210bd92577ff30ce9e36e7f9114889
SHA512 125d650ab94dd1b5b2e5dc9ea6111e92d09c96868cfc366ce16ef294da6baf4bf8d8a2b3a9626264a5ff2fc1d2977c1e23d22470075da478750c0a238fd46d36
SSDEEP 768:k6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:z8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 8328b128e8691b466491225a3a7eaf9377389915bd9553151855afe4ac0edad4
MD5 55ff185a28b30544cd52af035445fa0c
SHA1 3140140510f14b982ec71cb2938cf966a7517cf7
SHA512 1a2772d11ffe52a2e07fcc10a7e8a7d4c3ffd6edce1e7ea3897ce9184867abfbd0c082c192cdafca1c4d98c7d03c4bedcdb56ce7fcc79a1a9f751e57fd3fdd12
SSDEEP 768:Q6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:n8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 35KB
SHA256 5cee3eae7c87d379e582a0db2469e5c7c7c1eec7de0742903d3fd72626a68666
MD5 7aa55e8976cd752899788997aa75ee4b
SHA1 f6a3239199df61576131d5217aac585926ea98fb
SHA512 cdd81c2528a8b62509750a2d6a1ff7a9fdf7ec3ed87ce3c6d9481deec1b19704ce76aebf84e28222e90ba93d2805bcef8db7f512c111617297312dfb007e92f5
SSDEEP 768:t6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:g8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3808-19-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3808-24-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3876-28-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3876-26-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4488-5-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4488-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4976-13-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4976-18-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4976-14-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4976-10-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4976-7-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4976-4-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads