neconyd | b3019d1fa0edf00d681239298dacd606d007d03f47eb7941d7c8b10caa1706c1

Analysis

max time kernel
114s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a204f9dedf0dd81629ada4ff71a138c0N.exe
Size

61KB
MD5

a204f9dedf0dd81629ada4ff71a138c0
SHA1

5967412ecf216707518350a9fa8432f53f3d0b66
SHA256

b3019d1fa0edf00d681239298dacd606d007d03f47eb7941d7c8b10caa1706c1
SHA512

060d2367f7fab9e6176c41a874c8cf6dba8706312b7a588e944c9938c7934135513274a186dc36e738d797ed50b14bda28e6f0600e43f896e539290c8841c343
SSDEEP

768:JMEIvFGvZEr8LFK0ic46N47eSdYAHwmZ7Bp6JXXlaa5uA:JbIvYvZEyFKF6N4yS+AQmZIl/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 3 IoCs

pid	Process
2672	omsecor.exe
2312	omsecor.exe
2204	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a204f9dedf0dd81629ada4ff71a138c0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 2672	3728	a204f9dedf0dd81629ada4ff71a138c0N.exe	86
PID 3728 wrote to memory of 2672	3728	a204f9dedf0dd81629ada4ff71a138c0N.exe	86
PID 3728 wrote to memory of 2672	3728	a204f9dedf0dd81629ada4ff71a138c0N.exe	86
PID 2672 wrote to memory of 2312	2672	omsecor.exe	99
PID 2672 wrote to memory of 2312	2672	omsecor.exe	99
PID 2672 wrote to memory of 2312	2672	omsecor.exe	99
PID 2312 wrote to memory of 2204	2312	omsecor.exe	100
PID 2312 wrote to memory of 2204	2312	omsecor.exe	100
PID 2312 wrote to memory of 2204	2312	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\a204f9dedf0dd81629ada4ff71a138c0N.exe
"C:\Users\Admin\AppData\Local\Temp\a204f9dedf0dd81629ada4ff71a138c0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
f700e481d97a23a2684e67e3e080199f

SHA1
01fbd0938c4011da758b116f87f0bd07b622c552

SHA256
f6efde3a0e040c5b2a9086016969a5c48345a69b22ce263b84ce30a39825672a

SHA512
10d9cdfa5c212da1aaec91e3af4277b37637ab63872478500e9281091e4ebdd873eb6adb6b2ce94feeb9e1ac2b2fa5e2729390e07300817e7f8dcffb83db0641

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
63824186fcd1f38bbf998569d6e76da9

SHA1
6336b0539f9366b48d56b7feeb1ed6f50093bd7c

SHA256
06f995f2565516f2feba438d067eb3b25d4d6b9a740bc73683e15fb0061dd94c

SHA512
9883245ab8d69e033833ef828ae2f1f3572a3d34c649a8ab688a8a9b71293052eed2a0845bcc1c425a21c52c877209eac1e28752de1176c17536e5f090fb60ec

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
61KB

MD5
8bda7841a4717a62fd70ca390bd982fd

SHA1
5ca67a35896a872054bc0f4d54222315c77abc2e

SHA256
038a30ecdfaaa7a8bdb487fc90b3a2c1d49a49bf7d6b26d317f87a4899e516bc

SHA512
d83e83aaf9137b67555fb72160fa3234b95305ef6c39848ce9cd766ebcf57cbe698d562f8b39903ff1c6e2363f5516abef6822e4d621ad8686546dd7c61fdde8

Download Submit