neconyd | 08a6d48023bfb0bd20efc0c6f73d6ddeb1a33ca1024d3fa86583815ea31dfe48

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5491c55ae49f285cfc4605bf8a9d6cd0N.exe
Size 96KB
Sample240817-jf47aavamb
SHA256 08a6d48023bfb0bd20efc0c6f73d6ddeb1a33ca1024d3fa86583815ea31dfe48
MD5 5491c55ae49f285cfc4605bf8a9d6cd0
SHA1 02efbbf4adc3cfca01a69ae57e3c261112df5ff8
SHA512 a3dff1d1580917f4b3d0ea3a30c80061e2522a9a7eafafcfb521a311aba3e20eedec325a86380e6e6d5f9232c808f20f73f062ee48a9ec9ec09732eeaf54c2ad
SSDEEP 1536:fnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:fGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
2484	omsecor.exe
2312	omsecor.exe
4968	omsecor.exe
4668	omsecor.exe
2972	omsecor.exe
1412	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2280 set thread context of 3004	2280	5491c55ae49f285cfc4605bf8a9d6cd0N.exe	84
PID 2484 set thread context of 2312	2484	omsecor.exe	89
PID 4968 set thread context of 4668	4968	omsecor.exe	108
PID 2972 set thread context of 1412	2972	omsecor.exe	111

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3028	2280	WerFault.exe	83
5068	2484	WerFault.exe	86
4568	4968	WerFault.exe	107
4408	2972	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5491c55ae49f285cfc4605bf8a9d6cd0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5491c55ae49f285cfc4605bf8a9d6cd0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 3004	2280	5491c55ae49f285cfc4605bf8a9d6cd0N.exe	84
PID 2280 wrote to memory of 3004	2280	5491c55ae49f285cfc4605bf8a9d6cd0N.exe	84
PID 2280 wrote to memory of 3004	2280	5491c55ae49f285cfc4605bf8a9d6cd0N.exe	84
PID 2280 wrote to memory of 3004	2280	5491c55ae49f285cfc4605bf8a9d6cd0N.exe	84
PID 2280 wrote to memory of 3004	2280	5491c55ae49f285cfc4605bf8a9d6cd0N.exe	84
PID 3004 wrote to memory of 2484	3004	5491c55ae49f285cfc4605bf8a9d6cd0N.exe	86
PID 3004 wrote to memory of 2484	3004	5491c55ae49f285cfc4605bf8a9d6cd0N.exe	86
PID 3004 wrote to memory of 2484	3004	5491c55ae49f285cfc4605bf8a9d6cd0N.exe	86
PID 2484 wrote to memory of 2312	2484	omsecor.exe	89
PID 2484 wrote to memory of 2312	2484	omsecor.exe	89
PID 2484 wrote to memory of 2312	2484	omsecor.exe	89
PID 2484 wrote to memory of 2312	2484	omsecor.exe	89
PID 2484 wrote to memory of 2312	2484	omsecor.exe	89
PID 2312 wrote to memory of 4968	2312	omsecor.exe	107
PID 2312 wrote to memory of 4968	2312	omsecor.exe	107
PID 2312 wrote to memory of 4968	2312	omsecor.exe	107
PID 4968 wrote to memory of 4668	4968	omsecor.exe	108
PID 4968 wrote to memory of 4668	4968	omsecor.exe	108
PID 4968 wrote to memory of 4668	4968	omsecor.exe	108
PID 4968 wrote to memory of 4668	4968	omsecor.exe	108
PID 4968 wrote to memory of 4668	4968	omsecor.exe	108
PID 4668 wrote to memory of 2972	4668	omsecor.exe	110
PID 4668 wrote to memory of 2972	4668	omsecor.exe	110
PID 4668 wrote to memory of 2972	4668	omsecor.exe	110
PID 2972 wrote to memory of 1412	2972	omsecor.exe	111
PID 2972 wrote to memory of 1412	2972	omsecor.exe	111
PID 2972 wrote to memory of 1412	2972	omsecor.exe	111
PID 2972 wrote to memory of 1412	2972	omsecor.exe	111
PID 2972 wrote to memory of 1412	2972	omsecor.exe	111

C:\Users\Admin\AppData\Local\Temp\5491c55ae49f285cfc4605bf8a9d6cd0N.exe
"C:\Users\Admin\AppData\Local\Temp\5491c55ae49f285cfc4605bf8a9d6cd0N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\5491c55ae49f285cfc4605bf8a9d6cd0N.exe
  C:\Users\Admin\AppData\Local\Temp\5491c55ae49f285cfc4605bf8a9d6cd0N.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2312
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4968
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 256
        8⤵
        Program crash
        
        PID:4408
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 292
        6⤵
        Program crash
        
        PID:4568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 300
      4⤵
      Program crash
      PID:5068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 300
  2⤵
  - Program crash
  PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 348 -p 2280 -ip 2280
1⤵
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2484 -ip 2484
1⤵
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4968 -ip 4968
1⤵
PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2972 -ip 2972
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 1b49e4edcc6ab24f317799da8bcdd2846fd3df572bd7f8665d5fd5dad02692d6
MD5 11bc8857d1ac9a1e006baa03e9ac2c12
SHA1 d14426835e2b6c984a2e1b1853fc07d7a69f7d80
SHA512 26658702d372701187865ca602377ae10a0e93d00266d6a70ef97f6a036cdf94238ebef4c5b9c3a28ef751dc0791f29b5b3d8a30770d804bb9c726e55b6e8a16
SSDEEP 1536:9nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:9Gs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 4069ecfab7a39223d7c1c384153d37bc1522e91d9b34ae9f5a91b53bedf0960b
MD5 366949fbbc77a384c1ba9e607a0f0cba
SHA1 c251f0847e741208623f8da0ae1da12baf5af216
SHA512 df37e3678aed4274d3486bccb326097fb59cd61c32deaefb41398ed40eff522423f27e46720ed860f26c407f5984e6b3debe433446ab518c84666d0de3e3ddfa
SSDEEP 1536:vnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:vGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 71c92713fc1a67a0b6291b422b26939b4f28c8a8a41be0bdb665fc615119792c
MD5 12f5c734fa88467313b4450e9c324e4c
SHA1 0becbe6f749cd5c126589c97660c695b3e2f5e57
SHA512 69f2f23c88a427db49b4b0b6cc4c13b6eec10a29288b4119f9d28db2151b9db5e58b6a6e372ed5d931237f18a55d28eb0d66b4b3de46c6ee98696faf3069789e
SSDEEP 1536:JnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:JGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1412-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1412-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1412-53-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2280-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2280-18-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2312-29-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2312-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2312-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2312-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2312-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2312-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2312-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2484-11-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2484-17-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2972-44-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3004-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3004-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3004-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3004-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4668-39-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4668-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4668-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4968-31-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4968-51-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads