neconyd | f7482e028b5429a0b7e73f250db7e75465d922317bd3e926797b78b9a0eadd65

Analysis

max time kernel
115s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5137682cfd1570081e325a18027f8d40N.exe
Size 248KB
Sample240817-qectzaxble
SHA256 f7482e028b5429a0b7e73f250db7e75465d922317bd3e926797b78b9a0eadd65
MD5 5137682cfd1570081e325a18027f8d40
SHA1 0f70ce6c59b86e1190b2436b02b37618f4d3916b
SHA512 02481630684f00f571361ef6f74ca9df8d43884fd311ef811d0a74afb6d33fe12bc586d4d0eae811cc95ad9b7d3ca1e193ed05f411a0b3e044a392204fda56cb
SSDEEP 1536:a4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:aIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2780	omsecor.exe
1980	omsecor.exe
2872	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2764	5137682cfd1570081e325a18027f8d40N.exe
2764	5137682cfd1570081e325a18027f8d40N.exe
2780	omsecor.exe
2780	omsecor.exe
1980	omsecor.exe
1980	omsecor.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2764-0-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/files/0x0008000000012118-7.dat	upx
behavioral1/memory/2764-8-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2780-10-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2780-12-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/files/0x0035000000016d5a-16.dat	upx
behavioral1/memory/2780-17-0x0000000000390000-0x00000000003CE000-memory.dmp	upx
behavioral1/memory/2780-23-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/files/0x0008000000012118-28.dat	upx
behavioral1/memory/1980-29-0x00000000002D0000-0x000000000030E000-memory.dmp	upx
behavioral1/memory/1980-35-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2872-38-0x0000000000400000-0x000000000043E000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5137682cfd1570081e325a18027f8d40N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2780	2764	5137682cfd1570081e325a18027f8d40N.exe	30
PID 2764 wrote to memory of 2780	2764	5137682cfd1570081e325a18027f8d40N.exe	30
PID 2764 wrote to memory of 2780	2764	5137682cfd1570081e325a18027f8d40N.exe	30
PID 2764 wrote to memory of 2780	2764	5137682cfd1570081e325a18027f8d40N.exe	30
PID 2780 wrote to memory of 1980	2780	omsecor.exe	32
PID 2780 wrote to memory of 1980	2780	omsecor.exe	32
PID 2780 wrote to memory of 1980	2780	omsecor.exe	32
PID 2780 wrote to memory of 1980	2780	omsecor.exe	32
PID 1980 wrote to memory of 2872	1980	omsecor.exe	33
PID 1980 wrote to memory of 2872	1980	omsecor.exe	33
PID 1980 wrote to memory of 2872	1980	omsecor.exe	33
PID 1980 wrote to memory of 2872	1980	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\5137682cfd1570081e325a18027f8d40N.exe
"C:\Users\Admin\AppData\Local\Temp\5137682cfd1570081e325a18027f8d40N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 248KB
SHA256 baa00850fed32a3e2a309eea277f4faad7d422736f97c4bfe0ef9e01627d8e70
MD5 e202a15e25475446a7447f7589108f0e
SHA1 248db9c894bc58f4ecab67e399e9674339a3ccdf
SHA512 ac939bf87f4ec53b02483cce3196f4e876425724f74f70dc9d7bc091f06ac00852b34d48eff9782e39855362a5f4df4dcbcc43c8802978f3dae28753bee5b259
SSDEEP 1536:m4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:mIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 248KB
SHA256 a270ca053a5d30d100010b8f541780ab40a6f4f23ecf74cea0fa8fe5801d92a1
MD5 139f0d41cfe6d0d170792eb81ad3a162
SHA1 2de5f144843c2773035075099a0a94ebd21f4a01
SHA512 c647d41601affe1ab086a5d46867f3f55edd3cc439cc8c14b1e64a25e10cf6337be91a9699d4054f64c4ddc9cc1669d89735897b025dd4290a2b77c2849e8b82
SSDEEP 1536:p4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:pIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 248KB
SHA256 68141e37a2ee2d89c4ba2b6af1e57bd5607ed9006af66d0b20dc9b88c3ef0153
MD5 cca640be6d4583e9bcd25b957f2858a2
SHA1 e8f73da54625595e6895d0c79809e00e2d8f4153
SHA512 5093ee77897ef39a7cbcfe5cfd76def9461da79278382411ed0cdf53688debc07bfc849d892b194b70041e332ebb2468af878a9a7b5de4196c1de600fa683f81
SSDEEP 1536:54d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:5IdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1980-35-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1980-29-0x00000000002D0000-0x000000000030E000-memory.dmp

Download

memory/2764-8-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2764-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2780-10-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2780-23-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2780-25-0x0000000000390000-0x00000000003CE000-memory.dmp

Download

memory/2780-17-0x0000000000390000-0x00000000003CE000-memory.dmp

Download

memory/2780-12-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2872-38-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads