neconyd | aa785ad971e52046093566ccdf1c349021ce7077aa1f5780eb78fd1fc3cb44c4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2024, 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa785ad971e52046093566ccdf1c349021ce7077aa1f5780eb78fd1fc3cb44c4.exe
Size

90KB
MD5

938312316541b2ea8df97ead25238756
SHA1

3c521109cb6909591eb61cced5ccc1ffd2dcf923
SHA256

aa785ad971e52046093566ccdf1c349021ce7077aa1f5780eb78fd1fc3cb44c4
SHA512

efb1179aca0f3f1e350e9e6a117297e7d24b41dc62fa16019926e0f27ab760f528f8bd71e121257f0d922368f6b1cab0029ce43e9a289a92bbb56eb6b1377d36
SSDEEP

768:yMEIvFGvZEr8LFK0ic46N4zeSdPAHwmZGp6JXXlaa5uAO:ybIvYvZEyFKF6N4aS5AQmZTl/5G

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
3636	omsecor.exe
1560	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa785ad971e52046093566ccdf1c349021ce7077aa1f5780eb78fd1fc3cb44c4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 3636	220	aa785ad971e52046093566ccdf1c349021ce7077aa1f5780eb78fd1fc3cb44c4.exe	84
PID 220 wrote to memory of 3636	220	aa785ad971e52046093566ccdf1c349021ce7077aa1f5780eb78fd1fc3cb44c4.exe	84
PID 220 wrote to memory of 3636	220	aa785ad971e52046093566ccdf1c349021ce7077aa1f5780eb78fd1fc3cb44c4.exe	84
PID 3636 wrote to memory of 1560	3636	omsecor.exe	101
PID 3636 wrote to memory of 1560	3636	omsecor.exe	101
PID 3636 wrote to memory of 1560	3636	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\aa785ad971e52046093566ccdf1c349021ce7077aa1f5780eb78fd1fc3cb44c4.exe
"C:\Users\Admin\AppData\Local\Temp\aa785ad971e52046093566ccdf1c349021ce7077aa1f5780eb78fd1fc3cb44c4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:220
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
90KB

MD5
8d690621cd20aa5428505dd0bd5a107c

SHA1
9088335cb566eb1d936fd2386dc0201cad66e93c

SHA256
4933758db4701b2e9019d26f7459ed84748b2b57b8d3b5460a7b4c497eca6126

SHA512
1bc4d9f6a4324aca728a0a06ab01dafddb2ba89f7b069fa2deec948f1c9eb9f6baa5244c273e204cf3f7b5b01c036872357368aa015ab6de9724b9e88b3e0cd2

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
90KB

MD5
f34e34d9b95179f08288e7ad8c4eb798

SHA1
6b03e0fadb6e5779e4b4da59dbeb4da5bf4e0235

SHA256
ca347df041187178cb8f1dc9cd3f80b57fd780a7a8302b4ec54f8cbd8e869ef6

SHA512
450d2852a291bd3242f589e32c28fbbb4ebee5e9c1353b5fc43f59bdd39175e538d5cd723685aa251d779f7252419a93b10bf53703e98f4ed6e791300e61548e

Download Submit
memory/220-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/220-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1560-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1560-14-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3636-5-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3636-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3636-12-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download