neconyd | 34fce2719fc153d1a1358a6af870787c3261730a4c3f3b098eab70d6418dda1f

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2024, 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34fce2719fc153d1a1358a6af870787c3261730a4c3f3b098eab70d6418dda1f.exe
Size

68KB
MD5

5b93ed1c83192a9c9a3b8400c6320e7d
SHA1

2edde326e9b9b5d27f68fa2e6e45f868aa4ece55
SHA256

34fce2719fc153d1a1358a6af870787c3261730a4c3f3b098eab70d6418dda1f
SHA512

72e761161b410a46db0879afc16b67fe21d9bf4da862db56011949c52c0314058de3de463bc0688e5a96f62aab1821896c02ebe15ecf4bdf01c7e62062081cca
SSDEEP

1536:7d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5v:LdseIOMEZEyFjEOFqTiQm5l/5v

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
944	omsecor.exe
5004	omsecor.exe
5000	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34fce2719fc153d1a1358a6af870787c3261730a4c3f3b098eab70d6418dda1f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 944	4480	34fce2719fc153d1a1358a6af870787c3261730a4c3f3b098eab70d6418dda1f.exe	82
PID 4480 wrote to memory of 944	4480	34fce2719fc153d1a1358a6af870787c3261730a4c3f3b098eab70d6418dda1f.exe	82
PID 4480 wrote to memory of 944	4480	34fce2719fc153d1a1358a6af870787c3261730a4c3f3b098eab70d6418dda1f.exe	82
PID 944 wrote to memory of 5004	944	omsecor.exe	92
PID 944 wrote to memory of 5004	944	omsecor.exe	92
PID 944 wrote to memory of 5004	944	omsecor.exe	92
PID 5004 wrote to memory of 5000	5004	omsecor.exe	93
PID 5004 wrote to memory of 5000	5004	omsecor.exe	93
PID 5004 wrote to memory of 5000	5004	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\34fce2719fc153d1a1358a6af870787c3261730a4c3f3b098eab70d6418dda1f.exe
"C:\Users\Admin\AppData\Local\Temp\34fce2719fc153d1a1358a6af870787c3261730a4c3f3b098eab70d6418dda1f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
68KB

MD5
fec8cd55ef79853a9b7a4ef2d0fbba50

SHA1
4401e65c543b4e848f31ce103cd34542b7fc7369

SHA256
102d84c4e2635acea852ef80a658ee0584a7a05e0f55dfbaf9a8f213513bfcb1

SHA512
12881046002dbaeb94758f4f1305df18982b0685c5e4b477fda4267c3a674969de96c4295aef9869661028f735a1f12c615bfbf9eba2418c4ec1e77477225e86

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
68KB

MD5
052c64b82e47bd1f3281b15b7461f693

SHA1
4bde9848e79054b4e77374f15a51a67d68c2e182

SHA256
12eddac140e896fedd1c7aea329061808d4a450c6e5bda912b7b9f674fc15da9

SHA512
61e98fea562fb9c7fbe1f822f52bb373a3ba42927a7bc3bf048aa3ed593b91962b438c331ac6487466831949df52326d4839d5b18a2015aabcb32a6002dc75f1

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
68KB

MD5
505e4cbc213cd403f6855fc241fc719b

SHA1
a842b5b956519507f187f42e3d89a0df643ffa2b

SHA256
83148ecf31a459aa3a66d37cc105eb08e7c2faf303984cad92d413a322233d91

SHA512
a72880020d66eb1200b1a7ffdd5bd823302eaee095dd08fca26a5b1e712b1e037a73b49510b0e0f9718f965c151d0dee9ca13d878aae0d8f1e4f5335105a3cf4

Download Submit