neconyd | f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601

Analysis

max time kernel
115s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2024 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601.exe
Size

76KB
MD5

8f2aa25aad326a413b41937ff400fda2
SHA1

6dbe919017ba75ec80ece116791f984cf6775c60
SHA256

f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601
SHA512

16c21011cd972720d49c4b8b7cc75f7ff77f323d80deb48a2ee567785784e8a160111142743865977740627c89575e7d0b9d4651dfd7e9b7a169dad75bc570ee
SSDEEP

1536:3d9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11T:/dseIOMEZEyFjEOFqaiQm5l/5w11T

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
4668	omsecor.exe
4284	omsecor.exe
4232	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 4668	1552	f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601.exe	83
PID 1552 wrote to memory of 4668	1552	f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601.exe	83
PID 1552 wrote to memory of 4668	1552	f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601.exe	83
PID 4668 wrote to memory of 4284	4668	omsecor.exe	100
PID 4668 wrote to memory of 4284	4668	omsecor.exe	100
PID 4668 wrote to memory of 4284	4668	omsecor.exe	100
PID 4284 wrote to memory of 4232	4284	omsecor.exe	101
PID 4284 wrote to memory of 4232	4284	omsecor.exe	101
PID 4284 wrote to memory of 4232	4284	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601.exe
"C:\Users\Admin\AppData\Local\Temp\f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
20554c7d7f9bee0c6be0cb79a1830b3c

SHA1
ebc7ac4b81546d7f1eebb90c3cd42f428dec6413

SHA256
317b8cc156821a21557f2299c025ed00657a3a0d4923b057ed2f32b3da83ad3d

SHA512
76d6eaca04f87b045d1f25977cebc3565b648459366c32e4b1aaf85903cc4f0086893347f4a0bd00e7ffbc78def869365dc057d9cbe2330cf930441b7155d9aa

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
eaa4361347a07df5f2fb7813d054700b

SHA1
e6c16242aa83076ccd720d1eae6d741afd477f50

SHA256
29586849d09d3052c56895b28a5abd812b49e73880f37b0203d9ae1373f7dc2d

SHA512
4a8c25330f5b5fa1135cd0f2cf21f3761f274523d9555a199075984ea8a4d12d5052d5812468a49e9b540d8062aa14be87e76bdb4202ba82515a4c240d84117a

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
76KB

MD5
4f893423578593e2030e05de5b014998

SHA1
b7158689956bfdb5bf7d13d603e876997070e953

SHA256
eca7c6081a90659ff11732ce7347cf46366a4fd19c310510aca7f0ec0accc808

SHA512
ab7328cab24e78f42f57df941ea9c94f7780ebd65c016c5fa9060af1e2ea5450a73b0252c10cf07766514232fb96d5b332b7293136612e7299216f2db6ab4b0e

Download Submit
memory/1552-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1552-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4232-17-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4232-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4284-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4284-18-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4668-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4668-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4668-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download