neconyd | f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2024, 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601.exe
Size

76KB
MD5

8f2aa25aad326a413b41937ff400fda2
SHA1

6dbe919017ba75ec80ece116791f984cf6775c60
SHA256

f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601
SHA512

16c21011cd972720d49c4b8b7cc75f7ff77f323d80deb48a2ee567785784e8a160111142743865977740627c89575e7d0b9d4651dfd7e9b7a169dad75bc570ee
SSDEEP

1536:3d9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11T:/dseIOMEZEyFjEOFqaiQm5l/5w11T

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
604	omsecor.exe
4312	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 604	3864	f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601.exe	84
PID 3864 wrote to memory of 604	3864	f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601.exe	84
PID 3864 wrote to memory of 604	3864	f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601.exe	84
PID 604 wrote to memory of 4312	604	omsecor.exe	101
PID 604 wrote to memory of 4312	604	omsecor.exe	101
PID 604 wrote to memory of 4312	604	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601.exe
"C:\Users\Admin\AppData\Local\Temp\f16a64d890ba2a1693e82f61a59641f95e04751ce47b4e364b02b06e10616601.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:604
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
eaa4361347a07df5f2fb7813d054700b

SHA1
e6c16242aa83076ccd720d1eae6d741afd477f50

SHA256
29586849d09d3052c56895b28a5abd812b49e73880f37b0203d9ae1373f7dc2d

SHA512
4a8c25330f5b5fa1135cd0f2cf21f3761f274523d9555a199075984ea8a4d12d5052d5812468a49e9b540d8062aa14be87e76bdb4202ba82515a4c240d84117a

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
76KB

MD5
62ffaad5bd37c2b014ceb9b010dd4521

SHA1
aad7633476f88324f6e46df8608f6ff301761070

SHA256
df8abd8daf6aa306c2e669814e839d2444bff971911c933ae633f6ee03571ccd

SHA512
59c85deffa0e3e47080cd282c5b9eb56ce2361f99dfdec2999550bcf3c9923fd1ba8988537ff76d1172b1e13273e1443c04ce3b6340866581baa779e44a422f2

Download Submit
memory/604-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/604-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/604-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3864-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3864-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4312-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4312-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download