neconyd | 9974edd227c48dfe696723c15b6d828d945dc40054c3a53664da8fdb67fca35a

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dc9f0dcb65de8b78dfc92ed5c71c4c80N.exe
Size 33KB
Sample240817-a7dc7sxekf
SHA256 9974edd227c48dfe696723c15b6d828d945dc40054c3a53664da8fdb67fca35a
MD5 dc9f0dcb65de8b78dfc92ed5c71c4c80
SHA1 b77268e96877922551a8dd4b164c9ba74202d141
SHA512 2167f4271850a18b414e0d30033ad297e58688764c371f4a17eec3a9229ea2a9ed7361230de56022f09e39928e71a0783cf260ea6d9ec33593beac2e0dbd7aaa
SSDEEP 768:jfVhP/4kt3+9IV6Y90ksQ1oWHT0hh0vy9S5fsYGbTmoN/yE56hlSQ7D:jfVRztyHo8QNHTk0qE5fslvN/956q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4952	omsecor.exe
1624	omsecor.exe
2000	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc9f0dcb65de8b78dfc92ed5c71c4c80N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 4952	3568	dc9f0dcb65de8b78dfc92ed5c71c4c80N.exe	84
PID 3568 wrote to memory of 4952	3568	dc9f0dcb65de8b78dfc92ed5c71c4c80N.exe	84
PID 3568 wrote to memory of 4952	3568	dc9f0dcb65de8b78dfc92ed5c71c4c80N.exe	84
PID 4952 wrote to memory of 1624	4952	omsecor.exe	106
PID 4952 wrote to memory of 1624	4952	omsecor.exe	106
PID 4952 wrote to memory of 1624	4952	omsecor.exe	106
PID 1624 wrote to memory of 2000	1624	omsecor.exe	107
PID 1624 wrote to memory of 2000	1624	omsecor.exe	107
PID 1624 wrote to memory of 2000	1624	omsecor.exe	107

C:\Users\Admin\AppData\Local\Temp\dc9f0dcb65de8b78dfc92ed5c71c4c80N.exe
"C:\Users\Admin\AppData\Local\Temp\dc9f0dcb65de8b78dfc92ed5c71c4c80N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 33KB
SHA256 1a44b3e43b43430e0149beecb9551ad1f3028962ce26340372c3c88f383c3bae
MD5 1d03c72cd4738588d7c392791c004c7b
SHA1 9484ffc58ece20dbfe5f0f8705005f37faa4fe82
SHA512 991e36e60430c695cf06752f6f4322ad31086cc03a662c36ba08b16f2f0c4d43d7436c9fb045d9fbe8071f66b841d5bbaf464e3a7257acc80a91b91fcd5a5d54
SSDEEP 768:ifVhP/4kt3+9IV6Y90ksQ1oWHT0hh0vy9S5fsYGbTmoN/yE56hlSQ7D:ifVRztyHo8QNHTk0qE5fslvN/956q
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 33KB
SHA256 83696fcf5be5c489dc72448d8e9a013ece8dbe826d381ff95cc5c709caa125c0
MD5 060bb1bfbcf55685bb129ab0164b2662
SHA1 4d2d16d11ba02fbdc58fdc4a01794eb9a571252e
SHA512 4273716db6b45ec124d8d42ae762c55f6e8379ca5bbcf6a4ef70f20af76729d59030102ac68290875376ccb86cd0b3060e5b2138b64e98e69a730f04de55f40f
SSDEEP 768:XfVhP/4kt3+9IV6Y90ksQ1oWHT0hh0vy9S5fsYGbTmoN/yE56hlSQ7D:XfVRztyHo8QNHTk0qE5fslvN/956q
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 33KB
SHA256 2f7708a971a99935541c8c3301dbec4e458106ef66025598a8b57e684ad418ee
MD5 fc18015b5202bcbbc8ccc3f70859d585
SHA1 78e5acf4807e681541f6ebfe52a96fd44b3bf3df
SHA512 865903dc98946b09e25e7b3e6f660d9829f9897f52808396f0eb2e2f972682518940bac382dcced70e6cafc078c73e942199967bab8ef5c18f914a18afa16ef1
SSDEEP 768:OfVhP/4kt3+9IV6Y90ksQ1oWHT0hh0vy9S5fsYGbTmoN/yE56hlSQ7D:OfVRztyHo8QNHTk0qE5fslvN/956q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1624-18-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1624-26-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2000-28-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2000-24-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3568-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3568-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4952-13-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4952-19-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4952-14-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4952-10-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4952-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4952-4-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads