neconyd | 2c5e3dd714059961c81f62f787103661aceffb8c04435d699f41e38090cb5a76

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2024, 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c5e3dd714059961c81f62f787103661aceffb8c04435d699f41e38090cb5a76.exe
Size

90KB
MD5

7d8abf864e959016909ef1bb03a5283b
SHA1

fef274a39a2396d64bcddc5b72fc8f471091a4ec
SHA256

2c5e3dd714059961c81f62f787103661aceffb8c04435d699f41e38090cb5a76
SHA512

89b73f1b4b6c061fa094c4b9684f583684424c67ad4a6d82b66727b91fb5cd1ca4771fbb11b4dc78d5dacd1457baed020da66f8ad20a08527f40ed399b12e05a
SSDEEP

768:kMEIvFGvZEr8LFK0ic46N4zeSdPAHwmZGp6JXXlaa5uA6:kbIvYvZEyFKF6N4aS5AQmZTl/5C

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
2000	omsecor.exe
5052	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c5e3dd714059961c81f62f787103661aceffb8c04435d699f41e38090cb5a76.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 2000	392	2c5e3dd714059961c81f62f787103661aceffb8c04435d699f41e38090cb5a76.exe	82
PID 392 wrote to memory of 2000	392	2c5e3dd714059961c81f62f787103661aceffb8c04435d699f41e38090cb5a76.exe	82
PID 392 wrote to memory of 2000	392	2c5e3dd714059961c81f62f787103661aceffb8c04435d699f41e38090cb5a76.exe	82
PID 2000 wrote to memory of 5052	2000	omsecor.exe	92
PID 2000 wrote to memory of 5052	2000	omsecor.exe	92
PID 2000 wrote to memory of 5052	2000	omsecor.exe	92

C:\Users\Admin\AppData\Local\Temp\2c5e3dd714059961c81f62f787103661aceffb8c04435d699f41e38090cb5a76.exe
"C:\Users\Admin\AppData\Local\Temp\2c5e3dd714059961c81f62f787103661aceffb8c04435d699f41e38090cb5a76.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:392
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
90KB

MD5
2e6aa43df4788a28fa2c7dbe5ae584bd

SHA1
e3228257dbb163da4879f5e7b3bc09dba730dd85

SHA256
e269f616135e88717f541577cd86bd2ef261f112f8c13a16480093fdfc0ed7a1

SHA512
c2dd1a4483ad32be42cba40f48a4442d7317f78b35e9a38903f432b9aa8cb52dffa78939c663191cc2fbe0ba2bbde2d210c6c9306930912e0e3bf0ef4cfacefa

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
90KB

MD5
45e78e4b798dc424bb4ccd55aa71a435

SHA1
7e6b78f404319c1a4310920cfe4d8997b49e6573

SHA256
08d21b203f8eeef222b378c803efee56de0cd9bd9d4fdd4870b25ca95017daf0

SHA512
2d2279cf1e1be1b4fb99ef9d27d88eb8c69e1ec2fd470adbb5c9e15a38e2001d2ba8dfdd6b925865e0b5353d8bbbe3b164071b934922d79ea2fb68ea87aaea6f

Download Submit
memory/392-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/392-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2000-5-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2000-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2000-13-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5052-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5052-14-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download