neconyd | 07f5cca07cc63a5f18e9d6851d88902c49aa4447873e183482e8d399e405f172

Analysis

max time kernel
116s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8eece6f5324bf1526d6e0881d638f170N.exe
Size 248KB
Sample240819-mfcc2syekc
SHA256 07f5cca07cc63a5f18e9d6851d88902c49aa4447873e183482e8d399e405f172
MD5 8eece6f5324bf1526d6e0881d638f170
SHA1 d930a6fc12953b01a2afa7e9ed5c435d94f43c3b
SHA512 70541a2ae65c5e34322ea2dee7c58465e46881a6f9b2c45bad7e989451de8f08d662365897db05d73272f5b73adfb07fd75ab7a0d25b0653a1c3411303e7b6fd
SSDEEP 1536:44d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:4IdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
4244	omsecor.exe
3624	omsecor.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1400-0-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/files/0x000900000002342d-3.dat	upx
behavioral2/memory/4244-4-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/1400-5-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/4244-7-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/3624-11-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/files/0x000400000001e735-10.dat	upx
behavioral2/memory/4244-13-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/3624-14-0x0000000000400000-0x000000000043E000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8eece6f5324bf1526d6e0881d638f170N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 4244	1400	8eece6f5324bf1526d6e0881d638f170N.exe	84
PID 1400 wrote to memory of 4244	1400	8eece6f5324bf1526d6e0881d638f170N.exe	84
PID 1400 wrote to memory of 4244	1400	8eece6f5324bf1526d6e0881d638f170N.exe	84
PID 4244 wrote to memory of 3624	4244	omsecor.exe	100
PID 4244 wrote to memory of 3624	4244	omsecor.exe	100
PID 4244 wrote to memory of 3624	4244	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\8eece6f5324bf1526d6e0881d638f170N.exe
"C:\Users\Admin\AppData\Local\Temp\8eece6f5324bf1526d6e0881d638f170N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 248KB
SHA256 f9d5e0817196061b67cc568d4792a55c5e8bf22b54e28f526efb9e062dfb8511
MD5 f7f9a1f2f66382acc65a061290ba5f04
SHA1 6ac4dbed0e0489e9838f1cb8acec1d505e25de2d
SHA512 452dd256ef4439af62687ccfec1100d87c316ed2fa676be3d323c160bd0a6a4e6eacfe9c86560858453fe356f6fb804f9e03b9e090ce3f1518d603e9352fb0fa
SSDEEP 1536:w4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:wIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 248KB
SHA256 a7538fcbd69678da6d0f25c59ecaca7df44f33528b2326400830c4771e19bccc
MD5 2d0772cb24774f91faafa5c182fb993c
SHA1 16b3146e2d6fcd13cacf01496f38b0e9232d4e95
SHA512 f1ce0445c4d1768d8156531115c4f2a83b3c92ea26e9c15366014543ffaad4226aa06758afc337e3c7ea2ebb77c54ceac847721f99be787a5139968dfbbf1298
SSDEEP 1536:c4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:cIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1400-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1400-5-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3624-11-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3624-14-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4244-4-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4244-7-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4244-13-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads