neconyd | 992565db16ea10b24896a693d4259db3ae08a93978c7d71876d85f414d8798f0

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2024, 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

992565db16ea10b24896a693d4259db3ae08a93978c7d71876d85f414d8798f0.exe
Size

92KB
MD5

78e7041bd176cf644b9bb8e7ac03792f
SHA1

312f5348786e05a83fff434dad909ce5851cfa77
SHA256

992565db16ea10b24896a693d4259db3ae08a93978c7d71876d85f414d8798f0
SHA512

2e8c442e8d4b6207dc88bb3bf70441d773843580d93a98f973805e49a9bb7bd0af537e0548e00f11b784d0355e3b5e7540f61efd13f63355b9ddacbc31ebe6ad
SSDEEP

1536:gd9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5d:AdseIOyEZEyFjEOFqTiQm5l/5d

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
1984	omsecor.exe
3824	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	992565db16ea10b24896a693d4259db3ae08a93978c7d71876d85f414d8798f0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 1984	4808	992565db16ea10b24896a693d4259db3ae08a93978c7d71876d85f414d8798f0.exe	83
PID 4808 wrote to memory of 1984	4808	992565db16ea10b24896a693d4259db3ae08a93978c7d71876d85f414d8798f0.exe	83
PID 4808 wrote to memory of 1984	4808	992565db16ea10b24896a693d4259db3ae08a93978c7d71876d85f414d8798f0.exe	83
PID 1984 wrote to memory of 3824	1984	omsecor.exe	100
PID 1984 wrote to memory of 3824	1984	omsecor.exe	100
PID 1984 wrote to memory of 3824	1984	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\992565db16ea10b24896a693d4259db3ae08a93978c7d71876d85f414d8798f0.exe
"C:\Users\Admin\AppData\Local\Temp\992565db16ea10b24896a693d4259db3ae08a93978c7d71876d85f414d8798f0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:3824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
92KB

MD5
8e4dab29b0f7720d7ae2e9e0228b3ca4

SHA1
e5affbf2f3680008f60a3778c0734b35b99e82b2

SHA256
cb69e0fa2454178bae57899e79a2b8c6d6f0c0a0c25b9367b057754cf7d088e7

SHA512
b041e5008b13fbf0499fd5bd90521826b4115b8a91e5aad9d98bb74a6eb880c22e979cd4773611a7e232c04412b94e814309867e18485b123bfb461db4150677

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
92KB

MD5
03f222aafe2da2dad827f3fc3c9a5dcf

SHA1
356d33569bb4ef6e113f4ce0e99dc5d969dabb05

SHA256
081da370d6d97fa83cb82d40a55735b9e7dd1f40e76ab4acc8265e10fe0f31d7

SHA512
478ffde5691381907b12a9675fa95de1cfbd42532a8f3250840c09adba6ae5174a64869ad41182eb8614c58095f657208de6145cf22d751a8f87ad84c013c89a

Download Submit
memory/1984-4-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1984-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1984-12-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3824-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3824-14-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4808-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4808-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download