neconyd | 5839afb099cf5ab836040cb7660e88c1d931bdfdb781949a83227ac43aee47f1

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2024, 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5839afb099cf5ab836040cb7660e88c1d931bdfdb781949a83227ac43aee47f1.exe
Size

248KB
MD5

95e357eca6a4db7b1fb3eefc1909d023
SHA1

2c7a499102a75c0c465e4ac7de8620e0d734490c
SHA256

5839afb099cf5ab836040cb7660e88c1d931bdfdb781949a83227ac43aee47f1
SHA512

0e12f75f5990d849fb3d72763dd5ebfc5c67e3b268c3b5ec77dc5ff7826ed28db8abfa563280eecb2af54cb1468d38450a54dadcb30f378c7fe3284f9c53c0c0
SSDEEP

1536:14d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:1IdseIO+EZEyFjEOFqTiQmGnOHjzU

Score

10^/10

neconyd discovery trojan upx

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
3720	omsecor.exe
1596	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3604-0-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/files/0x000d000000023c1f-3.dat	upx
behavioral2/memory/3720-4-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/3604-6-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/3720-7-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/files/0x000800000001e786-10.dat	upx
behavioral2/memory/1596-12-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/3720-13-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral2/memory/1596-14-0x0000000000400000-0x000000000043E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5839afb099cf5ab836040cb7660e88c1d931bdfdb781949a83227ac43aee47f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 3720	3604	5839afb099cf5ab836040cb7660e88c1d931bdfdb781949a83227ac43aee47f1.exe	83
PID 3604 wrote to memory of 3720	3604	5839afb099cf5ab836040cb7660e88c1d931bdfdb781949a83227ac43aee47f1.exe	83
PID 3604 wrote to memory of 3720	3604	5839afb099cf5ab836040cb7660e88c1d931bdfdb781949a83227ac43aee47f1.exe	83
PID 3720 wrote to memory of 1596	3720	omsecor.exe	100
PID 3720 wrote to memory of 1596	3720	omsecor.exe	100
PID 3720 wrote to memory of 1596	3720	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\5839afb099cf5ab836040cb7660e88c1d931bdfdb781949a83227ac43aee47f1.exe
"C:\Users\Admin\AppData\Local\Temp\5839afb099cf5ab836040cb7660e88c1d931bdfdb781949a83227ac43aee47f1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
248KB

MD5
2e38a4c09a813036dbbafcf261cbc230

SHA1
cb4f5758eeba01f7d414cca3da6618e4b589eadd

SHA256
dac6ff95132c3a6fb7c4745ac3e9b42e35f5db53af5e7f5176758c8d99004f79

SHA512
0168d1f47ec437e33e972134a7c3ae43e0c4a0f294bbcf16550561b5c0578d21bd6b4f9208e8b468250aed5f38581a765b22bf7c60c9ec61f5df5789d7d594c1

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
248KB

MD5
28d4f3712066275d53e1f5be464b7c06

SHA1
aa66f387c84180b273ad859c15615026f5016f1c

SHA256
8a98d7f59fcdbb196a3534bed88412cbf52b6170550177f28f3b3d7efbc1a00e

SHA512
2bff10969b0afab38fcef7ecb7de361b3d41fdc0aae7bbca083280c3d2f44d0d9006effffd1bb96936868a1432247e9f3d350de1c52927fb29c8bdedeada4623

Download Submit
memory/1596-12-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1596-14-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3604-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3604-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3720-4-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3720-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3720-13-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download