neconyd | 92c7124f2cbe8a6fc29075273a0d9bffde30fc2c3620b95e409017c7dbd43aea

Analysis

max time kernel
114s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d1ae6973803661f902959102677aee0N.exe
Size 248KB
Sample240819-snp7rsvdql
SHA256 92c7124f2cbe8a6fc29075273a0d9bffde30fc2c3620b95e409017c7dbd43aea
MD5 5d1ae6973803661f902959102677aee0
SHA1 9a8575442b23f1692f7fe9933061c797a8678e9e
SHA512 7f031228fc624456735daa937cd740124de715f59551ee8dd66d2eaa885e6ef3b311accd3e3b6981efd698aaf44111369fdeb11ec1e612d5158b6bca14962a12
SSDEEP 1536:Q4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:QIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
4996	omsecor.exe
4880	omsecor.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1088-0-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/files/0x000900000002341d-3.dat	upx
behavioral2/memory/4996-5-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/1088-6-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/4996-7-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/files/0x000500000001693b-9.dat	upx
behavioral2/memory/4880-12-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/4996-13-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/4880-14-0x0000000000400000-0x000000000043E000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d1ae6973803661f902959102677aee0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 4996	1088	5d1ae6973803661f902959102677aee0N.exe	84
PID 1088 wrote to memory of 4996	1088	5d1ae6973803661f902959102677aee0N.exe	84
PID 1088 wrote to memory of 4996	1088	5d1ae6973803661f902959102677aee0N.exe	84
PID 4996 wrote to memory of 4880	4996	omsecor.exe	100
PID 4996 wrote to memory of 4880	4996	omsecor.exe	100
PID 4996 wrote to memory of 4880	4996	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\5d1ae6973803661f902959102677aee0N.exe
"C:\Users\Admin\AppData\Local\Temp\5d1ae6973803661f902959102677aee0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 248KB
SHA256 a493c8ece9984023c6c3c1b6163d0c980816a292e8ba19fcaa353763b65dc8b8
MD5 e7154e147d8944086a8366f8251830b0
SHA1 d4e9704c2699c298642f6753d4977ee6399391df
SHA512 8934b9c7d7602fe293422871d4b5d2b868363af084c7724c4df5b29a4693d2c181d1175b9d3f476fc92e8236425cf8ede4de0f60117aa6ace774964ce56986b8
SSDEEP 1536:N4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:NIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 248KB
SHA256 855cf040830c748c8a3b3a6ea0701271bc9de3eaae41c636cd57a621c820aaf8
MD5 70e051b13d116d84e332087b34aa8f0c
SHA1 3a38f8eac5d0699f0c3e0be1e72d08506a119645
SHA512 0249f79421e05982c4dcecbfd1a615c952372cb01685b1d5250f86079022d1098fe7252a92d4947d912cd8a77b83334833600e564369ece7da05ec9895f2b045
SSDEEP 1536:p4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:pIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1088-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1088-6-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4880-12-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4880-14-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4996-5-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4996-7-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4996-13-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads