neconyd | 0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/11/2024, 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe
Size

134KB
MD5

fb41407c183c1dcd0abdf8a420899d80
SHA1

6d14527465cf44fb75034ff6b64633829ff86ed3
SHA256

0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39
SHA512

36c37fe8774e98b90ab9c846fcd12d397447914e4dde76c30fcc46ac60c7b95097f5485eea83834e9b60cf4432e231c5040d075bcc2fc920a8e68231a2514edb
SSDEEP

1536:BDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:hiRTeH0iqAW6J6f1tqF6dngNmaZCia

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2524	omsecor.exe
2152	omsecor.exe
1064	omsecor.exe
1632	omsecor.exe
2972	omsecor.exe
2288	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
1940	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe
1940	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe
2524	omsecor.exe
2152	omsecor.exe
2152	omsecor.exe
1632	omsecor.exe
1632	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2096 set thread context of 1940	2096	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	31
PID 2524 set thread context of 2152	2524	omsecor.exe	33
PID 1064 set thread context of 1632	1064	omsecor.exe	37
PID 2972 set thread context of 2288	2972	omsecor.exe	39

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1940	2096	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	31
PID 2096 wrote to memory of 1940	2096	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	31
PID 2096 wrote to memory of 1940	2096	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	31
PID 2096 wrote to memory of 1940	2096	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	31
PID 2096 wrote to memory of 1940	2096	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	31
PID 2096 wrote to memory of 1940	2096	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	31
PID 1940 wrote to memory of 2524	1940	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	32
PID 1940 wrote to memory of 2524	1940	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	32
PID 1940 wrote to memory of 2524	1940	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	32
PID 1940 wrote to memory of 2524	1940	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	32
PID 2524 wrote to memory of 2152	2524	omsecor.exe	33
PID 2524 wrote to memory of 2152	2524	omsecor.exe	33
PID 2524 wrote to memory of 2152	2524	omsecor.exe	33
PID 2524 wrote to memory of 2152	2524	omsecor.exe	33
PID 2524 wrote to memory of 2152	2524	omsecor.exe	33
PID 2524 wrote to memory of 2152	2524	omsecor.exe	33
PID 2152 wrote to memory of 1064	2152	omsecor.exe	36
PID 2152 wrote to memory of 1064	2152	omsecor.exe	36
PID 2152 wrote to memory of 1064	2152	omsecor.exe	36
PID 2152 wrote to memory of 1064	2152	omsecor.exe	36
PID 1064 wrote to memory of 1632	1064	omsecor.exe	37
PID 1064 wrote to memory of 1632	1064	omsecor.exe	37
PID 1064 wrote to memory of 1632	1064	omsecor.exe	37
PID 1064 wrote to memory of 1632	1064	omsecor.exe	37
PID 1064 wrote to memory of 1632	1064	omsecor.exe	37
PID 1064 wrote to memory of 1632	1064	omsecor.exe	37
PID 1632 wrote to memory of 2972	1632	omsecor.exe	38
PID 1632 wrote to memory of 2972	1632	omsecor.exe	38
PID 1632 wrote to memory of 2972	1632	omsecor.exe	38
PID 1632 wrote to memory of 2972	1632	omsecor.exe	38
PID 2972 wrote to memory of 2288	2972	omsecor.exe	39
PID 2972 wrote to memory of 2288	2972	omsecor.exe	39
PID 2972 wrote to memory of 2288	2972	omsecor.exe	39
PID 2972 wrote to memory of 2288	2972	omsecor.exe	39
PID 2972 wrote to memory of 2288	2972	omsecor.exe	39
PID 2972 wrote to memory of 2288	2972	omsecor.exe	39

C:\Users\Admin\AppData\Local\Temp\0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe
"C:\Users\Admin\AppData\Local\Temp\0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe
  C:\Users\Admin\AppData\Local\Temp\0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2152
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1064
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
113374a0b473bb07886bc0d67f6a5b2c

SHA1
40043675fbb210120ecd340342326a82bf7045bf

SHA256
cff8e03ab7766fc72006b978a59dd04956da0ec99e2c0fb86fc503d97b74129d

SHA512
5561a61a12fdf4381f3c85860fc6b24d6c8047928f30c62656818877bbc9ec64b947e9a3f4ed727f0927a87fe7fae6e8cd966bba8a1ada97256af81b6f8f1259

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
cccf974742dc51bd4217cc45301e469f

SHA1
ac7d4dfca1bbf75a52bd422dd4ce2623781ae866

SHA256
ba50a992151634e79d536eac207c8249e78ce5abec3cc9d99d8985e384793929

SHA512
e31451d94bcc3cd7c0e142350c60d5ba9e9210530acd065da6079efd8685ecdca49cc2d9629341773a9c0bf3616cc9b0e2be2bfba20b4a002a8518bf505d204f

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
9398fcd55c7cfd22d7cc2956a4ef8508

SHA1
45b519130995182d5ba6fbcc188d11e73a3849f5

SHA256
0880e8c55b29da47b1c5e5c30133f454dc475dd1b8ef15e6b99a013df3a5505f

SHA512
1188e23311ebad732f20f0b0cc593a1258de81bb5b023c11cd7bb3169eb25c3fd17d45fdee164d3c5c25fe4278f5247a550b5dc89dd0f4aefa774205b15d62b5

Download Submit
memory/1064-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1064-62-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1632-68-0x00000000001C0000-0x00000000001E4000-memory.dmp

Filesize
144KB

Download
memory/1940-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1940-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1940-6-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1940-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1940-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2096-1-0x0000000000460000-0x0000000000484000-memory.dmp

Filesize
144KB

Download
memory/2096-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2096-7-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2152-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2152-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2152-45-0x0000000000320000-0x0000000000344000-memory.dmp

Filesize
144KB

Download
memory/2152-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2152-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2152-33-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2288-86-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2524-21-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2524-29-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2972-77-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2972-84-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download