neconyd | 2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d

Analysis

max time kernel
114s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27/11/2024, 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe
Size

96KB
MD5

413943c6ee13467286abb93e4f8959ff
SHA1

5e6200d33110cfb5f18b7ac232dfc05c5b09b61f
SHA256

2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d
SHA512

885e2779c74cd0b6ee8b4731d215301e8f174f9e0f29cdddb19ace8d580c1cfec4252f807b2278972ea0c54ee41ac86c920865d30a825d39499d72be8edd3210
SSDEEP

1536:wnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxx5:wGs8cd8eXlYairZYqMddH135

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
3032	omsecor.exe
2676	omsecor.exe
1124	omsecor.exe
1336	omsecor.exe
1000	omsecor.exe
2188	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
3016	2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe
3016	2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe
3032	omsecor.exe
2676	omsecor.exe
2676	omsecor.exe
1336	omsecor.exe
1336	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2748 set thread context of 3016	2748	2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe	29
PID 3032 set thread context of 2676	3032	omsecor.exe	31
PID 1124 set thread context of 1336	1124	omsecor.exe	34
PID 1000 set thread context of 2188	1000	omsecor.exe	36

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 3016	2748	2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe	29
PID 2748 wrote to memory of 3016	2748	2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe	29
PID 2748 wrote to memory of 3016	2748	2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe	29
PID 2748 wrote to memory of 3016	2748	2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe	29
PID 2748 wrote to memory of 3016	2748	2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe	29
PID 2748 wrote to memory of 3016	2748	2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe	29
PID 3016 wrote to memory of 3032	3016	2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe	30
PID 3016 wrote to memory of 3032	3016	2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe	30
PID 3016 wrote to memory of 3032	3016	2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe	30
PID 3016 wrote to memory of 3032	3016	2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe	30
PID 3032 wrote to memory of 2676	3032	omsecor.exe	31
PID 3032 wrote to memory of 2676	3032	omsecor.exe	31
PID 3032 wrote to memory of 2676	3032	omsecor.exe	31
PID 3032 wrote to memory of 2676	3032	omsecor.exe	31
PID 3032 wrote to memory of 2676	3032	omsecor.exe	31
PID 3032 wrote to memory of 2676	3032	omsecor.exe	31
PID 2676 wrote to memory of 1124	2676	omsecor.exe	33
PID 2676 wrote to memory of 1124	2676	omsecor.exe	33
PID 2676 wrote to memory of 1124	2676	omsecor.exe	33
PID 2676 wrote to memory of 1124	2676	omsecor.exe	33
PID 1124 wrote to memory of 1336	1124	omsecor.exe	34
PID 1124 wrote to memory of 1336	1124	omsecor.exe	34
PID 1124 wrote to memory of 1336	1124	omsecor.exe	34
PID 1124 wrote to memory of 1336	1124	omsecor.exe	34
PID 1124 wrote to memory of 1336	1124	omsecor.exe	34
PID 1124 wrote to memory of 1336	1124	omsecor.exe	34
PID 1336 wrote to memory of 1000	1336	omsecor.exe	35
PID 1336 wrote to memory of 1000	1336	omsecor.exe	35
PID 1336 wrote to memory of 1000	1336	omsecor.exe	35
PID 1336 wrote to memory of 1000	1336	omsecor.exe	35
PID 1000 wrote to memory of 2188	1000	omsecor.exe	36
PID 1000 wrote to memory of 2188	1000	omsecor.exe	36
PID 1000 wrote to memory of 2188	1000	omsecor.exe	36
PID 1000 wrote to memory of 2188	1000	omsecor.exe	36
PID 1000 wrote to memory of 2188	1000	omsecor.exe	36
PID 1000 wrote to memory of 2188	1000	omsecor.exe	36

C:\Users\Admin\AppData\Local\Temp\2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe
"C:\Users\Admin\AppData\Local\Temp\2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe
  C:\Users\Admin\AppData\Local\Temp\2d8e2aa0f4c2421d8d882b20f89f5e4ca17868bf68b9494acf1988445a78a79d.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1124
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1336
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1000
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
884c6ba9da110dabdca212d37e1484f2

SHA1
00a8c7a9a954f4cd30d5de62a0fe987e9cd2b166

SHA256
c02f66c916ebf10d40b98bef3f9c6ca67425397a1ccb9baee9cae4b66df369c7

SHA512
67e4f10c62fda2b403dfba087b403619fcd3d7d7d3c6bbbafa593f47a6acb4425fdb6950da8e763833816e5bcd46a93d23be69c07c8a4085942d7f621efe8f10

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
1242c7b2606a0e2ec7969833c121e6f1

SHA1
77713296d937506a202b56f6c62a394765da1cfa

SHA256
948fc410b212eb545ad2e0cdf149f9ed6089d00066b4ba459d0a483d74506931

SHA512
06585267815f591d7e16350bf23b0c8d0a25ea0157e0fe4369c947aa9d5f6120704d34e8e786d1d54c02e469c5647f76b567f251e4cabaad39b8e5c32114e639

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
b663fa54def9b81745b46db7e88f3711

SHA1
a67213a571221b90f7b3ac5ea38cc513d6faf260

SHA256
8b25a429c4429eb2d6b88350400d88cc46d4e428de93c21f4e8ab9c0b5ba0eb0

SHA512
0faa438f83d9741fd7aa9a4459a25bef0476fdd07bf30e0c03161ca24421287fa639880ec65420775846a1d81c68606ea53e9def4969e1ec0f212b13bee1b760

Download Submit
memory/1000-87-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1124-66-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1124-57-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1336-71-0x00000000002C0000-0x00000000002E3000-memory.dmp

Filesize
140KB

Download
memory/2188-89-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2676-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2676-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2676-47-0x00000000002D0000-0x00000000002F3000-memory.dmp

Filesize
140KB

Download
memory/2676-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2676-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2676-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2748-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2748-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3016-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3016-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3016-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3016-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3016-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3032-31-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3032-24-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/3032-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download