neconyd | ef5315a288a29fadc0b5a9832641492f8cd9a8b99279a133faef3d22bee9b8de

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2024, 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118.exe
Size

128KB
MD5

aca1443b1acfdd03ddb28221b5b9de28
SHA1

1570e650764203e0f9775b3a5c0f5876f1501697
SHA256

ef5315a288a29fadc0b5a9832641492f8cd9a8b99279a133faef3d22bee9b8de
SHA512

a90aa5da8b9d7677749b25d0c93e8b6b3ad2722135cb946ba16be5ebb00a85b1c5f3da086f66780d914507f4cac4eabbbdbce1bd0a06c08491440e4e413c2983
SSDEEP

1536:HDfDbhERTatPLTLLbC+8BMNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabau:jiRTe3n8BMAW6J6f1tqF6dngNmaZrN

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
3372	omsecor.exe
960	omsecor.exe
4112	omsecor.exe
4036	omsecor.exe
4356	omsecor.exe
3008	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4596 set thread context of 3096	4596	aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118.exe	85
PID 3372 set thread context of 960	3372	omsecor.exe	89
PID 4112 set thread context of 4036	4112	omsecor.exe	111
PID 4356 set thread context of 3008	4356	omsecor.exe	115

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3068	4596	WerFault.exe	84
4180	3372	WerFault.exe	88
4824	4112	WerFault.exe	110
3184	4356	WerFault.exe	113

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 3096	4596	aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118.exe	85
PID 4596 wrote to memory of 3096	4596	aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118.exe	85
PID 4596 wrote to memory of 3096	4596	aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118.exe	85
PID 4596 wrote to memory of 3096	4596	aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118.exe	85
PID 4596 wrote to memory of 3096	4596	aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118.exe	85
PID 3096 wrote to memory of 3372	3096	aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118.exe	88
PID 3096 wrote to memory of 3372	3096	aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118.exe	88
PID 3096 wrote to memory of 3372	3096	aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118.exe	88
PID 3372 wrote to memory of 960	3372	omsecor.exe	89
PID 3372 wrote to memory of 960	3372	omsecor.exe	89
PID 3372 wrote to memory of 960	3372	omsecor.exe	89
PID 3372 wrote to memory of 960	3372	omsecor.exe	89
PID 3372 wrote to memory of 960	3372	omsecor.exe	89
PID 960 wrote to memory of 4112	960	omsecor.exe	110
PID 960 wrote to memory of 4112	960	omsecor.exe	110
PID 960 wrote to memory of 4112	960	omsecor.exe	110
PID 4112 wrote to memory of 4036	4112	omsecor.exe	111
PID 4112 wrote to memory of 4036	4112	omsecor.exe	111
PID 4112 wrote to memory of 4036	4112	omsecor.exe	111
PID 4112 wrote to memory of 4036	4112	omsecor.exe	111
PID 4112 wrote to memory of 4036	4112	omsecor.exe	111
PID 4036 wrote to memory of 4356	4036	omsecor.exe	113
PID 4036 wrote to memory of 4356	4036	omsecor.exe	113
PID 4036 wrote to memory of 4356	4036	omsecor.exe	113
PID 4356 wrote to memory of 3008	4356	omsecor.exe	115
PID 4356 wrote to memory of 3008	4356	omsecor.exe	115
PID 4356 wrote to memory of 3008	4356	omsecor.exe	115
PID 4356 wrote to memory of 3008	4356	omsecor.exe	115
PID 4356 wrote to memory of 3008	4356	omsecor.exe	115

C:\Users\Admin\AppData\Local\Temp\aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Users\Admin\AppData\Local\Temp\aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:960
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4112
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4036
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 256
        8⤵
        Program crash
        
        PID:3184
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 296
        6⤵
        Program crash
        
        PID:4824
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 288
      4⤵
      Program crash
      PID:4180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 252
  2⤵
  - Program crash
  PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4596 -ip 4596
1⤵
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3372 -ip 3372
1⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4112 -ip 4112
1⤵
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4356 -ip 4356
1⤵
PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
128KB

MD5
74280b03e0d94026a1e4409984279c13

SHA1
7af03f91c214bfa32fb4933a9dee2056c9be80e1

SHA256
b6453e4bae54f5ccaa07d4d4f0fe7d840bdee5ded422622eb5bc326b7a3e1927

SHA512
a0f16cc58760b7f9d9c7de880606bd4dadde81d6a25da4c96e366bd4dc34fc90930de9d7e78d90180272428d9ee6a59b0bba221b0fd9a4f7fc661d214cd8673a

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
128KB

MD5
c39822d4f341081460ea05ece8ea3d9c

SHA1
9222b43a7a62860f1e876340e133dcd3b60325ac

SHA256
77e31247b708bc5b751fa15ba3f024ab3e43c56d2845146ddd4d5d1784a56556

SHA512
29394cca6220cdd367a9369d4c9b619d2ec33abeb1628446e565cfe096a7be4d515f72e486e69d6c514ce7da26e91bcac0eedc8f5fa26b2d635dee6e3bbf0c4b

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
128KB

MD5
c401702f7821f5828120bf8c046fd873

SHA1
c6b7e063bfadf8ad73b735d0779198ca7d4e918f

SHA256
22665ea859231232e74ccf434bc98e346da524e48cae168fd1470722130da08a

SHA512
fae79313a8d06002a43e839c023dc882c2f1a845f8744992cdd54c1e0650e1e49dde86ecc3c342aee42e19b77fed0d4b65a2cc432469370c352fd58c55467b96

Download Submit
memory/960-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/960-13-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/960-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/960-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/960-17-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/960-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/960-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3008-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3008-46-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3008-43-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3008-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3096-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3096-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3096-4-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3096-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4036-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4036-30-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4036-31-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download