neconyd | b8d9d5ef60fb84883aaa612b37bf73ea01a65c314d009fcec060494e35606da6

Analysis

max time kernel
114s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cdbec37da7e211d89c93f134e419d8b0N.exe
Size 248KB
Sample240822-rs66ea1hrf
SHA256 b8d9d5ef60fb84883aaa612b37bf73ea01a65c314d009fcec060494e35606da6
MD5 cdbec37da7e211d89c93f134e419d8b0
SHA1 c802a35504add0d97d20437a7f8fb3f77f034460
SHA512 aa3e418562c983252aa308ec1febdccbad8db8013563902b13202057e2503111f000b933cd8be0b1a9af45d27483d05f97558321f7cfdf026bd93305b1bb3b51
SSDEEP 1536:w4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:wIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2728	omsecor.exe
1164	omsecor.exe
1736	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
2708	cdbec37da7e211d89c93f134e419d8b0N.exe
2708	cdbec37da7e211d89c93f134e419d8b0N.exe
2728	omsecor.exe
2728	omsecor.exe
1164	omsecor.exe
1164	omsecor.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2708-0-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2708-8-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2728-10-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/files/0x00080000000120ff-9.dat	upx
behavioral1/memory/2728-12-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-16.dat	upx
behavioral1/memory/1164-26-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2728-24-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/files/0x00080000000120ff-29.dat	upx
behavioral1/memory/1164-31-0x0000000000220000-0x000000000025E000-memory.dmp	upx
behavioral1/memory/1736-38-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/1164-37-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/1736-41-0x0000000000400000-0x000000000043E000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdbec37da7e211d89c93f134e419d8b0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2728	2708	cdbec37da7e211d89c93f134e419d8b0N.exe	30
PID 2708 wrote to memory of 2728	2708	cdbec37da7e211d89c93f134e419d8b0N.exe	30
PID 2708 wrote to memory of 2728	2708	cdbec37da7e211d89c93f134e419d8b0N.exe	30
PID 2708 wrote to memory of 2728	2708	cdbec37da7e211d89c93f134e419d8b0N.exe	30
PID 2728 wrote to memory of 1164	2728	omsecor.exe	33
PID 2728 wrote to memory of 1164	2728	omsecor.exe	33
PID 2728 wrote to memory of 1164	2728	omsecor.exe	33
PID 2728 wrote to memory of 1164	2728	omsecor.exe	33
PID 1164 wrote to memory of 1736	1164	omsecor.exe	34
PID 1164 wrote to memory of 1736	1164	omsecor.exe	34
PID 1164 wrote to memory of 1736	1164	omsecor.exe	34
PID 1164 wrote to memory of 1736	1164	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\cdbec37da7e211d89c93f134e419d8b0N.exe
"C:\Users\Admin\AppData\Local\Temp\cdbec37da7e211d89c93f134e419d8b0N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 248KB
SHA256 30f795cd5ed7569a6b2f7f07d46012bd37110c95221116d8fb3e09be8ab9583f
MD5 6b9c79da52d00bf09cdeb9eab3c39aa6
SHA1 c34cfa1a16814d31dee8e4fdaa75a57d0dd05174
SHA512 826fb2b17b0c29cd17950c02944148840eaf1d1e05db34fb605756a32992ec14d8af0a330da29e0e6023750c993a632d67bd92a12f5ac580d8698c9d6dec3a21
SSDEEP 1536:V4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:VIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Users\Admin\AppData\Roaming\omsecor.exe
Size 248KB
SHA256 8c8eda05afc56acbe2d95b36740987a5e5f40b24713346ddb2682aea79cc0dcb
MD5 41d8e12c43f66ef496e2cb299fcb4105
SHA1 91dc5bf4d49133b72c00a8806429083fd052fdc1
SHA512 e64c583220ea1fe02d57360cd1ef095984c1791ecfd5c3a330ca70efb223f116c6e2b745b388ec2d7e793557c375da911365af3381478d4e014fdbc86e5fbaf4
SSDEEP 1536:O4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:OIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path \Windows\SysWOW64\omsecor.exe
Size 248KB
SHA256 d2a683597b352b5d778bf745f1d82724d398d5bb6c7362a40bc2fd82bf385c85
MD5 5e462e554c60992daf8381dc36fd683e
SHA1 7aee5e09f262f88a1869df9c2e65168e356feae2
SHA512 c8db8622b07f570a7e4bd592022fdfae682a0414361fdadf23c9e4d6ee22ca9ce4c150595f3a732f817c6612fb0abcdfd478662eed28809945279b79df09f7a3
SSDEEP 1536:q4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:qIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1164-31-0x0000000000220000-0x000000000025E000-memory.dmp

Download

memory/1164-26-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1164-40-0x0000000000220000-0x000000000025E000-memory.dmp

Download

memory/1164-37-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1736-41-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1736-38-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2708-8-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2708-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2728-12-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2728-22-0x0000000000280000-0x00000000002BE000-memory.dmp

Download

memory/2728-23-0x0000000000280000-0x00000000002BE000-memory.dmp

Download

memory/2728-24-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2728-10-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads