neconyd | ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2024, 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424N.exe
Size

96KB
MD5

04563d75fcecf3eae1cc9006ac989ae0
SHA1

530f41c66f2c034780188d32d1caccfaa73613e3
SHA256

ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424
SHA512

156d89ff1ac103cc7294223d4dc23a44ac2c192990c36be7de47e75304376078903f7cd569d2f1d95af184a82a1e287258ce8133b78c9b193bfd0d8506635cbc
SSDEEP

1536:QnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:QGs8cd8eXlYairZYqMddH13L

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
4688	omsecor.exe
3608	omsecor.exe
1012	omsecor.exe
4068	omsecor.exe
2272	omsecor.exe
964	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1496 set thread context of 1808	1496	ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424N.exe	83
PID 4688 set thread context of 3608	4688	omsecor.exe	87
PID 1012 set thread context of 4068	1012	omsecor.exe	109
PID 2272 set thread context of 964	2272	omsecor.exe	113

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3448	1496	WerFault.exe	82
1952	4688	WerFault.exe	85
2800	1012	WerFault.exe	108
2680	2272	WerFault.exe	111

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1808	1496	ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424N.exe	83
PID 1496 wrote to memory of 1808	1496	ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424N.exe	83
PID 1496 wrote to memory of 1808	1496	ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424N.exe	83
PID 1496 wrote to memory of 1808	1496	ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424N.exe	83
PID 1496 wrote to memory of 1808	1496	ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424N.exe	83
PID 1808 wrote to memory of 4688	1808	ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424N.exe	85
PID 1808 wrote to memory of 4688	1808	ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424N.exe	85
PID 1808 wrote to memory of 4688	1808	ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424N.exe	85
PID 4688 wrote to memory of 3608	4688	omsecor.exe	87
PID 4688 wrote to memory of 3608	4688	omsecor.exe	87
PID 4688 wrote to memory of 3608	4688	omsecor.exe	87
PID 4688 wrote to memory of 3608	4688	omsecor.exe	87
PID 4688 wrote to memory of 3608	4688	omsecor.exe	87
PID 3608 wrote to memory of 1012	3608	omsecor.exe	108
PID 3608 wrote to memory of 1012	3608	omsecor.exe	108
PID 3608 wrote to memory of 1012	3608	omsecor.exe	108
PID 1012 wrote to memory of 4068	1012	omsecor.exe	109
PID 1012 wrote to memory of 4068	1012	omsecor.exe	109
PID 1012 wrote to memory of 4068	1012	omsecor.exe	109
PID 1012 wrote to memory of 4068	1012	omsecor.exe	109
PID 1012 wrote to memory of 4068	1012	omsecor.exe	109
PID 4068 wrote to memory of 2272	4068	omsecor.exe	111
PID 4068 wrote to memory of 2272	4068	omsecor.exe	111
PID 4068 wrote to memory of 2272	4068	omsecor.exe	111
PID 2272 wrote to memory of 964	2272	omsecor.exe	113
PID 2272 wrote to memory of 964	2272	omsecor.exe	113
PID 2272 wrote to memory of 964	2272	omsecor.exe	113
PID 2272 wrote to memory of 964	2272	omsecor.exe	113
PID 2272 wrote to memory of 964	2272	omsecor.exe	113

C:\Users\Admin\AppData\Local\Temp\ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424N.exe
"C:\Users\Admin\AppData\Local\Temp\ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Users\Admin\AppData\Local\Temp\ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424N.exe
  C:\Users\Admin\AppData\Local\Temp\ef876d4528e399a528fdbf22eeeb581e49d65a113bb945b15cea48da574fd424N.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3608
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1012
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 256
        8⤵
        Program crash
        
        PID:2680
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 304
        6⤵
        Program crash
        
        PID:2800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 292
      4⤵
      Program crash
      PID:1952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 288
  2⤵
  - Program crash
  PID:3448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1496 -ip 1496
1⤵
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4688 -ip 4688
1⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1012 -ip 1012
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2272 -ip 2272
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
33b53d4e4b62633decc8ecf6c7e5e270

SHA1
44aefb7c3029ab36cb62b8a7852550d555a8bca8

SHA256
7b27b119a2033c799570df2e789a51a6e1bf562dfa9d786ddadef01450cf7752

SHA512
86b6bb6fc3dc8848164f60b21c16b3f372ad8b3f37ca8a0a9cbc511292ac56608bc4a5e97e885138c717598aed85794e8d9049314720625997e117d861cd23d4

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
5d8468556ee467b3e085e9d7b333ef4a

SHA1
49de9504ce0911aa2341d9bc38f55d6a4352e191

SHA256
19dbe6824febf0a09bae240ec0a143903297ba7157ef31af3d3d713266f0f66e

SHA512
a5a71218bc75a4419e8ba6cacef7d812564e0fb4af0126158fc7f80a5f377f8cc570be88a04b0dc77ebd038badfe61fb736e11e4e854b82fc24ba3a7fe788852

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
abe4b8db385a47ba4b0d3b1456d03596

SHA1
40e8e7091ad4d24ec76fca2af51e73a7058c8643

SHA256
9267cd03205e1b87bb5817f8dc7aa16bbdeffc5567796991219048476e1a5c3d

SHA512
886ae6c073f4343d0697ee9275381ffe07b5f6ad37174e4ea21fc9e38895da1432dab67e48d3959180d5bfe6c0d5bceca6bf2e7b7eba40160508cb096df66823

Download Submit
memory/964-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/964-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/964-51-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1012-33-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1012-53-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1496-20-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1496-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1808-6-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1808-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1808-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1808-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2272-55-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2272-46-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3608-16-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3608-31-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3608-28-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3608-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3608-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3608-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3608-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4068-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4068-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4068-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4688-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4688-9-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download