neconyd | e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe
Size

96KB
MD5

8a7a253a61b0143f0d4ffb05e3e90f4a
SHA1

769c0b777b51b22916483415495b306ee427e838
SHA256

e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b
SHA512

a62efaacffb20ea4fc9b23130566ceef87f59a2e68eca2702baa725cb33d118456463f09e12173538942141e6a67f5f25eebd01bbdc033f9da7ebe0c75bab616
SSDEEP

1536:KnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:KGs8cd8eXlYairZYqMddH13L

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
2840	omsecor.exe
2852	omsecor.exe
2228	omsecor.exe
1956	omsecor.exe
2984	omsecor.exe
2196	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2776	e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe
2776	e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe
2840	omsecor.exe
2852	omsecor.exe
2852	omsecor.exe
1956	omsecor.exe
1956	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2720 set thread context of 2776	2720	e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe	30
PID 2840 set thread context of 2852	2840	omsecor.exe	32
PID 2228 set thread context of 1956	2228	omsecor.exe	36
PID 2984 set thread context of 2196	2984	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2776	2720	e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe	30
PID 2720 wrote to memory of 2776	2720	e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe	30
PID 2720 wrote to memory of 2776	2720	e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe	30
PID 2720 wrote to memory of 2776	2720	e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe	30
PID 2720 wrote to memory of 2776	2720	e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe	30
PID 2720 wrote to memory of 2776	2720	e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe	30
PID 2776 wrote to memory of 2840	2776	e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe	31
PID 2776 wrote to memory of 2840	2776	e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe	31
PID 2776 wrote to memory of 2840	2776	e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe	31
PID 2776 wrote to memory of 2840	2776	e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe	31
PID 2840 wrote to memory of 2852	2840	omsecor.exe	32
PID 2840 wrote to memory of 2852	2840	omsecor.exe	32
PID 2840 wrote to memory of 2852	2840	omsecor.exe	32
PID 2840 wrote to memory of 2852	2840	omsecor.exe	32
PID 2840 wrote to memory of 2852	2840	omsecor.exe	32
PID 2840 wrote to memory of 2852	2840	omsecor.exe	32
PID 2852 wrote to memory of 2228	2852	omsecor.exe	35
PID 2852 wrote to memory of 2228	2852	omsecor.exe	35
PID 2852 wrote to memory of 2228	2852	omsecor.exe	35
PID 2852 wrote to memory of 2228	2852	omsecor.exe	35
PID 2228 wrote to memory of 1956	2228	omsecor.exe	36
PID 2228 wrote to memory of 1956	2228	omsecor.exe	36
PID 2228 wrote to memory of 1956	2228	omsecor.exe	36
PID 2228 wrote to memory of 1956	2228	omsecor.exe	36
PID 2228 wrote to memory of 1956	2228	omsecor.exe	36
PID 2228 wrote to memory of 1956	2228	omsecor.exe	36
PID 1956 wrote to memory of 2984	1956	omsecor.exe	37
PID 1956 wrote to memory of 2984	1956	omsecor.exe	37
PID 1956 wrote to memory of 2984	1956	omsecor.exe	37
PID 1956 wrote to memory of 2984	1956	omsecor.exe	37
PID 2984 wrote to memory of 2196	2984	omsecor.exe	38
PID 2984 wrote to memory of 2196	2984	omsecor.exe	38
PID 2984 wrote to memory of 2196	2984	omsecor.exe	38
PID 2984 wrote to memory of 2196	2984	omsecor.exe	38
PID 2984 wrote to memory of 2196	2984	omsecor.exe	38
PID 2984 wrote to memory of 2196	2984	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe
"C:\Users\Admin\AppData\Local\Temp\e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Users\Admin\AppData\Local\Temp\e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe
  C:\Users\Admin\AppData\Local\Temp\e081f75a0f1a222e0b5740b34158810d6ab2169b63ecd7041f27747374457c4b.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2228
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
c0a9801f2d2ecea840d367ea797d4549

SHA1
02f0cf3f35ae10f625edfbd674267a05ab58c56e

SHA256
74de7521f8dbee88c0312329e1179170229bdb3202859b08a908d1f68486514c

SHA512
daa8a5acc8d24eff6b49e55c6ada20eb9f2c133c9315a8f295a538f833f75a6eaebe578fdbe6434a6f55d6a91c2ad1bbf66a6306436945f667acc7831d2b36b6

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
b57f491e8146b727e7824512136552b7

SHA1
df77a1da6cc02ecaf5385afd8d315b1bf3245603

SHA256
c36be5f90622250c450a9f9c60c070ff90dad2b1b70ef4cd8d1a44dab58703e8

SHA512
1e6f13aef07101400e5724b7248e56ce1e9704e5fdf3e88275100bedb0642cba3160a8063695f6ba17e2a02cdf09829700381b1a681e155993eba5b49c42e30b

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
efa83b75e4a3765d02a5257f73580e39

SHA1
c4239fa586c57cf2325cd7141875b5e74307027c

SHA256
4e9944bf5a751bc1dfae615e9130bd62ce147df7fe7320a7ac5d0391644efe44

SHA512
9334eec26456d1fb73af81212938c192dbf76c924aaae3453c04eee9ce81570fe8ae50e528ddfe584d7545a7d7bfe21f68f610d8df57dcc532a16658074166d4

Download Submit
memory/1956-79-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/1956-72-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2196-94-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-91-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2228-68-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2228-57-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2720-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2720-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2776-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2776-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2776-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2776-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2776-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2840-34-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2840-24-0x0000000000250000-0x0000000000273000-memory.dmp

Filesize
140KB

Download
memory/2840-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2852-55-0x0000000000470000-0x0000000000493000-memory.dmp

Filesize
140KB

Download
memory/2852-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2852-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2852-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2852-90-0x0000000000470000-0x0000000000493000-memory.dmp

Filesize
140KB

Download
memory/2852-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2852-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2984-88-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download