neconyd | 40e334861a43d950c9e37b2b1707f8c7ed2c5da8b4d8dfb6d2a83aa89fcd2733

Analysis

max time kernel
114s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0ff077e73ac896074b6a5e0fbb936740N.exe
Size 90KB
Sample240818-ct65gatark
SHA256 40e334861a43d950c9e37b2b1707f8c7ed2c5da8b4d8dfb6d2a83aa89fcd2733
MD5 0ff077e73ac896074b6a5e0fbb936740
SHA1 a5018432960f6f4f0779ea2c97cd5c436235b07a
SHA512 485e1e0b06ba70ecda50b4153562a3fb4ca919c39d1faba6ac8360fdfa3fe2c213dfd6cc480e7404b9022f1e7dc9720394a117d57cd183e0946e6719381c9727
SSDEEP 768:3MEIvFGvZEr8LFK0ic46N4zeSdPAHwmZGp6JXXlaa5uA:3bIvYvZEyFKF6N4aS5AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
1912	omsecor.exe
3896	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ff077e73ac896074b6a5e0fbb936740N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 1912	4824	0ff077e73ac896074b6a5e0fbb936740N.exe	84
PID 4824 wrote to memory of 1912	4824	0ff077e73ac896074b6a5e0fbb936740N.exe	84
PID 4824 wrote to memory of 1912	4824	0ff077e73ac896074b6a5e0fbb936740N.exe	84
PID 1912 wrote to memory of 3896	1912	omsecor.exe	100
PID 1912 wrote to memory of 3896	1912	omsecor.exe	100
PID 1912 wrote to memory of 3896	1912	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\0ff077e73ac896074b6a5e0fbb936740N.exe
"C:\Users\Admin\AppData\Local\Temp\0ff077e73ac896074b6a5e0fbb936740N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:3896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 90KB
SHA256 0012e2299e3d0e64226eaf715d35b057e094a590517753c06d6ecf5b8c205acf
MD5 bdd40aa2ab4663d8868ccb42bc328a3a
SHA1 be7755cac04e2a221d6c35b09489a4c791aac591
SHA512 e75839c36ec69518518f88d33efbbf25e06714a16698dc676ec6732aaf7a9b909b308bb4ef902c1caf6629e47671488a7ba73a3c9cf056b0c1e681c71e3d0413
SSDEEP 768:/MEIvFGvZEr8LFK0ic46N4zeSdPAHwmZGp6JXXlaa5uA:/bIvYvZEyFKF6N4aS5AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 90KB
SHA256 2eaad55d6f7bc22066d5397346cf796ade25079bcf267518aa78591a1da76284
MD5 1bacc2bcdd0d7d8608b108f75e17530a
SHA1 f6dc3a0eac4cd040873afdc3f2007ab70a48911f
SHA512 bb427a462569fee1b93ebea9843ae7089286523ebd6816c29375a2a662ee866bd07c44251b124a32a8cfbe443a3f1e1222de0861d64d70f94cf08798ae27ad29
SSDEEP 768:YMEIvFGvZEr8LFK0ic46N4zeSdPAHwmZGp6JXXlaa5uA:YbIvYvZEyFKF6N4aS5AQmZTl/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1912-4-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1912-7-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1912-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3896-12-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3896-14-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4824-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4824-6-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads