neconyd | 19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/11/2024, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe
Size

96KB
MD5

5d8468556ee467b3e085e9d7b333ef4a
SHA1

49de9504ce0911aa2341d9bc38f55d6a4352e191
SHA256

19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e
SHA512

a5a71218bc75a4419e8ba6cacef7d812564e0fb4af0126158fc7f80a5f377f8cc570be88a04b0dc77ebd038badfe61fb736e11e4e854b82fc24ba3a7fe788852
SSDEEP

1536:gnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:gGs8cd8eXlYairZYqMddH13L

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2176	omsecor.exe
1648	omsecor.exe
2552	omsecor.exe
1596	omsecor.exe
3012	omsecor.exe
3068	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2112	19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe
2112	19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe
2176	omsecor.exe
1648	omsecor.exe
1648	omsecor.exe
1596	omsecor.exe
1596	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2116 set thread context of 2112	2116	19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe	30
PID 2176 set thread context of 1648	2176	omsecor.exe	32
PID 2552 set thread context of 1596	2552	omsecor.exe	36
PID 3012 set thread context of 3068	3012	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2112	2116	19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe	30
PID 2116 wrote to memory of 2112	2116	19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe	30
PID 2116 wrote to memory of 2112	2116	19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe	30
PID 2116 wrote to memory of 2112	2116	19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe	30
PID 2116 wrote to memory of 2112	2116	19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe	30
PID 2116 wrote to memory of 2112	2116	19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe	30
PID 2112 wrote to memory of 2176	2112	19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe	31
PID 2112 wrote to memory of 2176	2112	19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe	31
PID 2112 wrote to memory of 2176	2112	19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe	31
PID 2112 wrote to memory of 2176	2112	19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe	31
PID 2176 wrote to memory of 1648	2176	omsecor.exe	32
PID 2176 wrote to memory of 1648	2176	omsecor.exe	32
PID 2176 wrote to memory of 1648	2176	omsecor.exe	32
PID 2176 wrote to memory of 1648	2176	omsecor.exe	32
PID 2176 wrote to memory of 1648	2176	omsecor.exe	32
PID 2176 wrote to memory of 1648	2176	omsecor.exe	32
PID 1648 wrote to memory of 2552	1648	omsecor.exe	35
PID 1648 wrote to memory of 2552	1648	omsecor.exe	35
PID 1648 wrote to memory of 2552	1648	omsecor.exe	35
PID 1648 wrote to memory of 2552	1648	omsecor.exe	35
PID 2552 wrote to memory of 1596	2552	omsecor.exe	36
PID 2552 wrote to memory of 1596	2552	omsecor.exe	36
PID 2552 wrote to memory of 1596	2552	omsecor.exe	36
PID 2552 wrote to memory of 1596	2552	omsecor.exe	36
PID 2552 wrote to memory of 1596	2552	omsecor.exe	36
PID 2552 wrote to memory of 1596	2552	omsecor.exe	36
PID 1596 wrote to memory of 3012	1596	omsecor.exe	37
PID 1596 wrote to memory of 3012	1596	omsecor.exe	37
PID 1596 wrote to memory of 3012	1596	omsecor.exe	37
PID 1596 wrote to memory of 3012	1596	omsecor.exe	37
PID 3012 wrote to memory of 3068	3012	omsecor.exe	38
PID 3012 wrote to memory of 3068	3012	omsecor.exe	38
PID 3012 wrote to memory of 3068	3012	omsecor.exe	38
PID 3012 wrote to memory of 3068	3012	omsecor.exe	38
PID 3012 wrote to memory of 3068	3012	omsecor.exe	38
PID 3012 wrote to memory of 3068	3012	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe
"C:\Users\Admin\AppData\Local\Temp\19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe
  C:\Users\Admin\AppData\Local\Temp\19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1648
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2552
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
db08c118128c51fcc1e47b23e03f127e

SHA1
c5c8bb9551641a6d0fb36d449e62bc2a55da6bc7

SHA256
fec3b464124940394d7b0f907b9f456eea6dc36afe28b82fdf31dba35eb8b7cc

SHA512
54e254dc2c45d5c8c92fb60217035ab2b009d99d027e5fd9a7d90dbcdead13d11b33ea004ea667bf69ef18b49f91f42cb2e691bbe6bfb0fc990b406a74d4bf28

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
832937ab4b07756fa4896cf36d10ff20

SHA1
fa9a877c827f32a3d76cb05e1258bec2e0803410

SHA256
3c52399184b49934211e8683e39365456926fd26b2ae4c0f0770627904439436

SHA512
fab8c8cc0993d19e641c712117e315600059ce92b26e50da4e960731e34999139fa4708fd7eca209ed78d21f0f21ec661ed41bbfa85f60705ce2cb990ce1de66

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
929965a083db2cfbd204bbb51eeec6d8

SHA1
e87984e1a30037b278d2cd22c8c67b203b121db0

SHA256
7585c69b68f03affcf9ad521346d0282da1a7eaed10a079ad2cb6ebafe0a3b59

SHA512
ea1d2f9f2ae711973e91c5a37f1ca460e77112c85cd49e1a4177717f187b6245bf1f3e3cd29145906a45c0133a91407919a1bdc746e7ae37be7aeb6847e9daa6

Download Submit
memory/1596-73-0x00000000003B0000-0x00000000003D3000-memory.dmp

Filesize
140KB

Download
memory/1648-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1648-54-0x00000000003B0000-0x00000000003D3000-memory.dmp

Filesize
140KB

Download
memory/1648-48-0x00000000003B0000-0x00000000003D3000-memory.dmp

Filesize
140KB

Download
memory/1648-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1648-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1648-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1648-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2112-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2112-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2112-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2112-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2112-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2116-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2116-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2176-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2176-33-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2176-24-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2552-58-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2552-67-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3012-88-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3068-90-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3068-93-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download