neconyd | b8d9d5ef60fb84883aaa612b37bf73ea01a65c314d009fcec060494e35606da6

Analysis

max time kernel
115s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cdbec37da7e211d89c93f134e419d8b0N.exe
Size 248KB
Sample240822-rs66ea1hrf
SHA256 b8d9d5ef60fb84883aaa612b37bf73ea01a65c314d009fcec060494e35606da6
MD5 cdbec37da7e211d89c93f134e419d8b0
SHA1 c802a35504add0d97d20437a7f8fb3f77f034460
SHA512 aa3e418562c983252aa308ec1febdccbad8db8013563902b13202057e2503111f000b933cd8be0b1a9af45d27483d05f97558321f7cfdf026bd93305b1bb3b51
SSDEEP 1536:w4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:wIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd discovery trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 2 IoCs

pid	Process
3668	omsecor.exe
1452	omsecor.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2248-0-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/files/0x0009000000023598-3.dat	upx
behavioral2/memory/2248-6-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/3668-5-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/3668-7-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/files/0x000a0000000235ac-10.dat	upx
behavioral2/memory/1452-11-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/3668-13-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/1452-14-0x0000000000400000-0x000000000043E000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdbec37da7e211d89c93f134e419d8b0N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 3668	2248	cdbec37da7e211d89c93f134e419d8b0N.exe	91
PID 2248 wrote to memory of 3668	2248	cdbec37da7e211d89c93f134e419d8b0N.exe	91
PID 2248 wrote to memory of 3668	2248	cdbec37da7e211d89c93f134e419d8b0N.exe	91
PID 3668 wrote to memory of 1452	3668	omsecor.exe	107
PID 3668 wrote to memory of 1452	3668	omsecor.exe	107
PID 3668 wrote to memory of 1452	3668	omsecor.exe	107

C:\Users\Admin\AppData\Local\Temp\cdbec37da7e211d89c93f134e419d8b0N.exe
"C:\Users\Admin\AppData\Local\Temp\cdbec37da7e211d89c93f134e419d8b0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4260,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:8
1⤵
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 248KB
SHA256 30f795cd5ed7569a6b2f7f07d46012bd37110c95221116d8fb3e09be8ab9583f
MD5 6b9c79da52d00bf09cdeb9eab3c39aa6
SHA1 c34cfa1a16814d31dee8e4fdaa75a57d0dd05174
SHA512 826fb2b17b0c29cd17950c02944148840eaf1d1e05db34fb605756a32992ec14d8af0a330da29e0e6023750c993a632d67bd92a12f5ac580d8698c9d6dec3a21
SSDEEP 1536:V4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:VIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 248KB
SHA256 251b668b5ae325651f45a4c98e468a9d813ae33794e088d6d76ac98e9c59ca1d
MD5 f6a0411dcd758c3d9c945d220b0321a8
SHA1 f1896718e616832955d4f212b4cf37e58d8aa4f5
SHA512 87a48566014484bc4d58e743cddf45f51cc90168d28df7a46e306102d7c16d7acc3e47ed3e09442e8f211724b7afef1d8e5b26270b792f4ae38fcd8861a51e59
SSDEEP 1536:T4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:TIdseIO+EZEyFjEOFqTiQmGnOHjzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1452-11-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1452-14-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2248-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2248-6-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3668-5-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3668-7-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3668-13-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads