neconyd | 540065f21daa8861400dfcc1708907f265395d332165d8ceca39baea42600418

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef136d4fea4454662428a0867eb01120N.exe
Size 96KB
Sample240817-svdsbasfjf
SHA256 540065f21daa8861400dfcc1708907f265395d332165d8ceca39baea42600418
MD5 ef136d4fea4454662428a0867eb01120
SHA1 d6c15759a55ba819205cdda36b2b3b9779dc2b45
SHA512 711dd6fe606dddd56c8623463c815bb11154ea9edd068d3d08e3a1754f297ea8830fa7da3a4312ebc1d887373cb5e736f0603733e1b598c5549556a785a3eaeb
SSDEEP 1536:LnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:LGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
1280	omsecor.exe
5012	omsecor.exe
1964	omsecor.exe
3156	omsecor.exe
3932	omsecor.exe
2516	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4480 set thread context of 3044	4480	ef136d4fea4454662428a0867eb01120N.exe	91
PID 1280 set thread context of 5012	1280	omsecor.exe	96
PID 1964 set thread context of 3156	1964	omsecor.exe	117
PID 3932 set thread context of 2516	3932	omsecor.exe	121

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1668	4480	WerFault.exe	90
4116	1280	WerFault.exe	94
4836	1964	WerFault.exe	116
732	3932	WerFault.exe	119

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef136d4fea4454662428a0867eb01120N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef136d4fea4454662428a0867eb01120N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 3044	4480	ef136d4fea4454662428a0867eb01120N.exe	91
PID 4480 wrote to memory of 3044	4480	ef136d4fea4454662428a0867eb01120N.exe	91
PID 4480 wrote to memory of 3044	4480	ef136d4fea4454662428a0867eb01120N.exe	91
PID 4480 wrote to memory of 3044	4480	ef136d4fea4454662428a0867eb01120N.exe	91
PID 4480 wrote to memory of 3044	4480	ef136d4fea4454662428a0867eb01120N.exe	91
PID 3044 wrote to memory of 1280	3044	ef136d4fea4454662428a0867eb01120N.exe	94
PID 3044 wrote to memory of 1280	3044	ef136d4fea4454662428a0867eb01120N.exe	94
PID 3044 wrote to memory of 1280	3044	ef136d4fea4454662428a0867eb01120N.exe	94
PID 1280 wrote to memory of 5012	1280	omsecor.exe	96
PID 1280 wrote to memory of 5012	1280	omsecor.exe	96
PID 1280 wrote to memory of 5012	1280	omsecor.exe	96
PID 1280 wrote to memory of 5012	1280	omsecor.exe	96
PID 1280 wrote to memory of 5012	1280	omsecor.exe	96
PID 5012 wrote to memory of 1964	5012	omsecor.exe	116
PID 5012 wrote to memory of 1964	5012	omsecor.exe	116
PID 5012 wrote to memory of 1964	5012	omsecor.exe	116
PID 1964 wrote to memory of 3156	1964	omsecor.exe	117
PID 1964 wrote to memory of 3156	1964	omsecor.exe	117
PID 1964 wrote to memory of 3156	1964	omsecor.exe	117
PID 1964 wrote to memory of 3156	1964	omsecor.exe	117
PID 1964 wrote to memory of 3156	1964	omsecor.exe	117
PID 3156 wrote to memory of 3932	3156	omsecor.exe	119
PID 3156 wrote to memory of 3932	3156	omsecor.exe	119
PID 3156 wrote to memory of 3932	3156	omsecor.exe	119
PID 3932 wrote to memory of 2516	3932	omsecor.exe	121
PID 3932 wrote to memory of 2516	3932	omsecor.exe	121
PID 3932 wrote to memory of 2516	3932	omsecor.exe	121
PID 3932 wrote to memory of 2516	3932	omsecor.exe	121
PID 3932 wrote to memory of 2516	3932	omsecor.exe	121

C:\Users\Admin\AppData\Local\Temp\ef136d4fea4454662428a0867eb01120N.exe
"C:\Users\Admin\AppData\Local\Temp\ef136d4fea4454662428a0867eb01120N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Users\Admin\AppData\Local\Temp\ef136d4fea4454662428a0867eb01120N.exe
  C:\Users\Admin\AppData\Local\Temp\ef136d4fea4454662428a0867eb01120N.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1280
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5012
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1964
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3932
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 268
        8⤵
        Program crash
        
        PID:732
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 292
        6⤵
        Program crash
        
        PID:4836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 304
      4⤵
      Program crash
      PID:4116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 288
  2⤵
  - Program crash
  PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4480 -ip 4480
1⤵
PID:996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1280 -ip 1280
1⤵
PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4380,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1964 -ip 1964
1⤵
PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3932 -ip 3932
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 8154122245337d69acc7de17152037a18e44b74ad72dedb2e4fed1f812a5aa41
MD5 16cbf294781d5d7b7d4fef7238ecb44a
SHA1 1a9c28478d0860c7b5730975f98e9ef393ce9844
SHA512 d2778d4adb2b573ae4a5a6b9b9f4bb891b07e3ddb106afbbe286e5d26fb8a9cc1a1c9702b61c9246112d9cd9726c2dd84631ac51c6d9027b62146457baf1d101
SSDEEP 1536:znAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:zGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 21f2a06fb820e15a85d36c3f447e2b8ce59a5580b3aae7fb9ce1da75d2f91e0d
MD5 831ed1d7f4d14ee67899185ed84273dc
SHA1 068bd9f0f3828011481fe47c56e407dd86a95c9a
SHA512 c85ccb13814f72ba28a320a0fef0268fb18277a3469636e6d43e2f1f0951ff1274a5b0a304da5343838ad9afedac312207f1063f01d75d62fb16b71082a59578
SSDEEP 1536:TnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:TGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 bc72f43cd276868a76e351cb69aec0b4d51543e560ace2a5bd2ec51edd52cf2b
MD5 3cd2c91a95d9f88d7254a61f2092d15d
SHA1 6d818f805903bd9b26d8d5a2fe2145de9304fbdf
SHA512 2d292f9cb4c7125bfed5ebd0fa14e380cf81eada07458d151efd392d83cbbaaaa302ef340b3115487b6a759a7fb13fe743a8c313d85cb97153ed68f2db06c801
SSDEEP 1536:rnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:rGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1280-19-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1280-11-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1964-33-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1964-52-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2516-54-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2516-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2516-50-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3044-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3044-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3044-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3044-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3156-40-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3156-38-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3156-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3932-45-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3932-53-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4480-17-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4480-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5012-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5012-31-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5012-27-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5012-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5012-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5012-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5012-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads