neconyd | e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2024, 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3.exe
Size

96KB
MD5

2b32d2832eb8548a895dbc2601b8a466
SHA1

894ae484347b6df1d07e1c3811cde83308d08329
SHA256

e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3
SHA512

f64a78d79f22d9f0c1550363777084537275dd351f33d2c272791b8ac1a43e92c57fdb104fa8131d134fec4bf6bd14e8fcbc51dfe00c1a9ccdb3d45b71041bef
SSDEEP

1536:0nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxh:0Gs8cd8eXlYairZYqMddH13h

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2160	omsecor.exe
908	omsecor.exe
3708	omsecor.exe
1660	omsecor.exe
4076	omsecor.exe
2636	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 624 set thread context of 3424	624	e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3.exe	82
PID 2160 set thread context of 908	2160	omsecor.exe	86
PID 3708 set thread context of 1660	3708	omsecor.exe	100
PID 4076 set thread context of 2636	4076	omsecor.exe	104

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3044	624	WerFault.exe	81
772	2160	WerFault.exe	84
5028	3708	WerFault.exe	99
4004	4076	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 3424	624	e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3.exe	82
PID 624 wrote to memory of 3424	624	e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3.exe	82
PID 624 wrote to memory of 3424	624	e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3.exe	82
PID 624 wrote to memory of 3424	624	e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3.exe	82
PID 624 wrote to memory of 3424	624	e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3.exe	82
PID 3424 wrote to memory of 2160	3424	e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3.exe	84
PID 3424 wrote to memory of 2160	3424	e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3.exe	84
PID 3424 wrote to memory of 2160	3424	e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3.exe	84
PID 2160 wrote to memory of 908	2160	omsecor.exe	86
PID 2160 wrote to memory of 908	2160	omsecor.exe	86
PID 2160 wrote to memory of 908	2160	omsecor.exe	86
PID 2160 wrote to memory of 908	2160	omsecor.exe	86
PID 2160 wrote to memory of 908	2160	omsecor.exe	86
PID 908 wrote to memory of 3708	908	omsecor.exe	99
PID 908 wrote to memory of 3708	908	omsecor.exe	99
PID 908 wrote to memory of 3708	908	omsecor.exe	99
PID 3708 wrote to memory of 1660	3708	omsecor.exe	100
PID 3708 wrote to memory of 1660	3708	omsecor.exe	100
PID 3708 wrote to memory of 1660	3708	omsecor.exe	100
PID 3708 wrote to memory of 1660	3708	omsecor.exe	100
PID 3708 wrote to memory of 1660	3708	omsecor.exe	100
PID 1660 wrote to memory of 4076	1660	omsecor.exe	102
PID 1660 wrote to memory of 4076	1660	omsecor.exe	102
PID 1660 wrote to memory of 4076	1660	omsecor.exe	102
PID 4076 wrote to memory of 2636	4076	omsecor.exe	104
PID 4076 wrote to memory of 2636	4076	omsecor.exe	104
PID 4076 wrote to memory of 2636	4076	omsecor.exe	104
PID 4076 wrote to memory of 2636	4076	omsecor.exe	104
PID 4076 wrote to memory of 2636	4076	omsecor.exe	104

C:\Users\Admin\AppData\Local\Temp\e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3.exe
"C:\Users\Admin\AppData\Local\Temp\e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:624
- C:\Users\Admin\AppData\Local\Temp\e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3.exe
  C:\Users\Admin\AppData\Local\Temp\e38d5be26e5e28d04d78b42898a881c2c38c7c3d3364a9bc0214ab62f6e0e8f3.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:908
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3708
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 244
        8⤵
        Program crash
        
        PID:4004
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 292
        6⤵
        Program crash
        
        PID:5028
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 292
      4⤵
      Program crash
      PID:772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 288
  2⤵
  - Program crash
  PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 624 -ip 624
1⤵
PID:4868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2160 -ip 2160
1⤵
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3708 -ip 3708
1⤵
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4076 -ip 4076
1⤵
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
d3cd17f63d5b29e43a7fceea11af42f1

SHA1
fff2b9ea21f0880457f6b2485109cfaa763820a3

SHA256
06e1dc9b6c54b47ada3fa9875309eb33f341ae60068fed6b54dcc609f8ae31ce

SHA512
d0855bff1bac33421624234463a4d8f03e808bb5f64b81a6eefcb03ff8b18c48d4f7515cc949aad75afa751042a0e5972b69f1a7a66bb8e07c8ff6cf8cc4a1ac

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
d48ed081dee2cb716a1daf825a1f6dd8

SHA1
8eedb531d719d8fb54478d7692b1fd707fe34074

SHA256
ce1052dbd9a40d7a4011189b9a8a4aa7c98fdefa587c2177f80ad865318778c9

SHA512
d40fbba8695e97f583ac6f3a4be991029d8c529cd24c8852504f315c6f2b78fd6a03bd7cb8bf895a997d2aa1e801d4d3e32827df7bc00d78d434f2671d1ad58b

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
3f5afbba1b14816cb526fe7c522f4784

SHA1
d9410b2c8646c1c9b820455903a60ed36a7f3fa4

SHA256
457b90ee312496cf5d4481218dda4b396ef238675953c46c90337af08fa682b1

SHA512
d9b7d11b8de71ac3ea60d7daf120279424e1220a9db87e15a463a970092595256fe3b52b344f44f75e9cbb5fce449ae03fa43f8c2698868f4c491d870ab9f6cd

Download Submit
memory/624-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/624-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/908-29-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/908-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/908-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/908-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/908-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/908-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/908-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1660-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1660-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1660-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2160-11-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2636-51-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2636-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2636-47-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2636-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3424-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3424-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3424-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3424-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3708-31-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3708-49-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4076-50-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4076-43-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download