neconyd | 8a9b9fa287da5abc1534b51b4bca69cbb90c1d8368f99a28975f3d02771d8272

Analysis

max time kernel
118s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 11:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7e8fa6228fac5d579fea1d2ed544fbe0N.exe
Size 35KB
Sample240822-nybd5svfmb
SHA256 8a9b9fa287da5abc1534b51b4bca69cbb90c1d8368f99a28975f3d02771d8272
MD5 7e8fa6228fac5d579fea1d2ed544fbe0
SHA1 a4261710427b1f6829ae3b8bbda56e56f54548fb
SHA512 1c47b40c4191dcb2644be2e0237a26546573d4740a9ba4c743e50f46e75c281dd97cc21ce651312f53a04cb357384b4dac3440fb78a3454962482baeef5baab1
SSDEEP 768:46vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:/8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
4808	omsecor.exe
4356	omsecor.exe
2252	omsecor.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/448-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x000900000002346c-3.dat	upx
behavioral2/memory/4808-4-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/448-7-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4808-8-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4808-11-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4808-14-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4808-15-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x000400000001e745-18.dat	upx
behavioral2/memory/4356-19-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/4808-22-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/files/0x000900000002346c-25.dat	upx
behavioral2/memory/4356-27-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2252-28-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/2252-30-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e8fa6228fac5d579fea1d2ed544fbe0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 4808	448	7e8fa6228fac5d579fea1d2ed544fbe0N.exe	84
PID 448 wrote to memory of 4808	448	7e8fa6228fac5d579fea1d2ed544fbe0N.exe	84
PID 448 wrote to memory of 4808	448	7e8fa6228fac5d579fea1d2ed544fbe0N.exe	84
PID 4808 wrote to memory of 4356	4808	omsecor.exe	99
PID 4808 wrote to memory of 4356	4808	omsecor.exe	99
PID 4808 wrote to memory of 4356	4808	omsecor.exe	99
PID 4356 wrote to memory of 2252	4356	omsecor.exe	100
PID 4356 wrote to memory of 2252	4356	omsecor.exe	100
PID 4356 wrote to memory of 2252	4356	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\7e8fa6228fac5d579fea1d2ed544fbe0N.exe
"C:\Users\Admin\AppData\Local\Temp\7e8fa6228fac5d579fea1d2ed544fbe0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:448
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 29362d5671e76d74dc4d3020e59d91a1dfcb8133de926f0ae969e0b69fccad6a
MD5 fd5f97d77470d723f83c136a6c3cba13
SHA1 f562602de4303bbb62065f34c4c59a1b8e10f902
SHA512 f7978945a3288060217639db57cfd2fa02d1b42011adae5238bfbe43e2a52fcb8bfd2c58fceb72388e8778c75c9609c26e8747c9f139068cc218f9acd7d4968d
SSDEEP 768:N6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:A8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 35KB
SHA256 e4e36401b6d22cc8ba7c01b9e0acb56b192737c40cbc7d1badc6f00c494cf5f1
MD5 bc33f801e7ddd733cb3502a9b7d3fed0
SHA1 c3bd765177da4a18b7f91889d7d7d562ca67bead
SHA512 6e9397226113fa8ee9a7399d3c7870ae2edb6a35b3e8912c50f1c041f61cca74299077d817d2f55b9b393444624f62737eabfcca591942c983b9e7337fa2ac78
SSDEEP 768:E6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:T8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 35KB
SHA256 79134386f9efab6197ec5f39408aa13038db79c767f9fde3f35cc5d2a016b03d
MD5 c6500c8b9a29fbc7ff2269c29c7852b9
SHA1 8fcb948055a7b9b0ee6f21a8758305e388b9d84c
SHA512 bdebe9cbc3b9ce367a9c7db54badd458472e806df2bd14c7d32f533646156cd0b06d491e548641def39ee03fa7b321d423d0cd1f1936297006863c389f64e98c
SSDEEP 768:l6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:o8Z0kA7FHlO2OwOTUtKjpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/448-7-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/448-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2252-30-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2252-28-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4356-19-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4356-27-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4808-15-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4808-14-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4808-22-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4808-11-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4808-8-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4808-4-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads