neconyd | 87cfa27f01d41a0b2ef28eca0be39ea8b810cab101203096b00d27a8f70b3222

Analysis

max time kernel
114s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4aec966a098b14cfa78cee94d3525a70N.exe
Size 248KB
Sample240820-d1lyjs1fnc
SHA256 87cfa27f01d41a0b2ef28eca0be39ea8b810cab101203096b00d27a8f70b3222
MD5 4aec966a098b14cfa78cee94d3525a70
SHA1 436a0465ef80cd38c5924a5fd8fe95c54b2d88a3
SHA512 46da6aeba548eb4bec019284d2a8d18cd8112038e00875d809ce2d0792e32d9ed26a53ea18503f33cfb22eacb2125c016733fccd830a2b8b78ab4a223c16f283
SSDEEP 1536:E4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:EIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
1592	omsecor.exe
2328	omsecor.exe
1052	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1736	4aec966a098b14cfa78cee94d3525a70N.exe
1736	4aec966a098b14cfa78cee94d3525a70N.exe
1592	omsecor.exe
1592	omsecor.exe
2328	omsecor.exe
2328	omsecor.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1736-1-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/files/0x000a00000001202b-2.dat	upx
behavioral1/memory/1592-10-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/1592-12-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/files/0x002f000000015d14-16.dat	upx
behavioral1/memory/1592-17-0x00000000002B0000-0x00000000002EE000-memory.dmp	upx
behavioral1/memory/1592-23-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2328-29-0x0000000000220000-0x000000000025E000-memory.dmp	upx
behavioral1/files/0x000a00000001202b-27.dat	upx
behavioral1/memory/2328-34-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/1052-37-0x0000000000400000-0x000000000043E000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4aec966a098b14cfa78cee94d3525a70N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1592	1736	4aec966a098b14cfa78cee94d3525a70N.exe	30
PID 1736 wrote to memory of 1592	1736	4aec966a098b14cfa78cee94d3525a70N.exe	30
PID 1736 wrote to memory of 1592	1736	4aec966a098b14cfa78cee94d3525a70N.exe	30
PID 1736 wrote to memory of 1592	1736	4aec966a098b14cfa78cee94d3525a70N.exe	30
PID 1592 wrote to memory of 2328	1592	omsecor.exe	32
PID 1592 wrote to memory of 2328	1592	omsecor.exe	32
PID 1592 wrote to memory of 2328	1592	omsecor.exe	32
PID 1592 wrote to memory of 2328	1592	omsecor.exe	32
PID 2328 wrote to memory of 1052	2328	omsecor.exe	33
PID 2328 wrote to memory of 1052	2328	omsecor.exe	33
PID 2328 wrote to memory of 1052	2328	omsecor.exe	33
PID 2328 wrote to memory of 1052	2328	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\4aec966a098b14cfa78cee94d3525a70N.exe
"C:\Users\Admin\AppData\Local\Temp\4aec966a098b14cfa78cee94d3525a70N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 248KB
SHA256 dadd7dba91edb83e3898c7c2e89919dded228f5a329b7912dc3c3680ea2a2e4f
MD5 370ad09d103c11cc25b3c336be13290c
SHA1 0cca7e2190f6ea2e8fdaebe4a7006b8bc8694c7c
SHA512 d494818b69fa76c5a6aa470936b33c84352a2399eb286b548a39c5a2c35381e84d2ebbc894756a843ee034d731bfa0c0d976a1ac63dadbe2bb5617a36f789452
SSDEEP 1536:74d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:7IdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 248KB
SHA256 e08867b02ee09e79c16d665b2860896882ed5ad71405a656cb202a2b1e229040
MD5 04ce65374d29df5ee431fe05e2604818
SHA1 46b3de07f1955c509a47c6cb8c1c27270632b390
SHA512 c1dd5ca528c51831824e845d5fdc7b148a1161d1903fe2e69395a5444e6fb91a69369cd618d6541e2cf9448c169fa16ceedb1fcabd953698130bc49608f4a8eb
SSDEEP 1536:34d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:3IdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 248KB
SHA256 163ce815dff33f757d35592aaff021636d26b54707fa670872cda6240f188274
MD5 4a234ee978b1900126a4cedab3007ec2
SHA1 7db2ef5c32e485a1f6f11886eb98df6f24379a0c
SHA512 380ce5f6582b19ce4dc3bbafa2bd539f7e8ec22a013b95da2167c59aeaf58fe56993454784cb4877864827ee51ccd5e8e5e229c0c81ed39b56b859bf10cd6a37
SSDEEP 1536:P4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:PIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1052-37-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1592-10-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1592-12-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1592-17-0x00000000002B0000-0x00000000002EE000-memory.dmp

Download

memory/1592-23-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1736-1-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1736-4-0x0000000000220000-0x000000000025E000-memory.dmp

Download

memory/2328-29-0x0000000000220000-0x000000000025E000-memory.dmp

Download

memory/2328-34-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads