neconyd | bc81a8367c9c5970fdfd8b653319d5c86b787f7cf46db0040acfdb3a4e9af602

Analysis

max time kernel
114s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc81a8367c9c5970fdfd8b653319d5c86b787f7cf46db0040acfdb3a4e9af602N.exe
Size

61KB
MD5

546baa01ff728e9da82b4e92ef66ed80
SHA1

76d58e0ef3fc4404558212cc38b3fe4814f03efe
SHA256

bc81a8367c9c5970fdfd8b653319d5c86b787f7cf46db0040acfdb3a4e9af602
SHA512

619a73362e672516a85af9802752622e7a25b55009772caf0f2373ebfefdf0c190df6524f53fe5b8fd9bd99d0d6b46eb2266a0df0bed60a8e950e607f45120d2
SSDEEP

1536:fd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZVl/5:XdseIOMEZEyFjEOFqTiQmzl/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
3956	omsecor.exe
1704	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc81a8367c9c5970fdfd8b653319d5c86b787f7cf46db0040acfdb3a4e9af602N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 3956	1188	bc81a8367c9c5970fdfd8b653319d5c86b787f7cf46db0040acfdb3a4e9af602N.exe	83
PID 1188 wrote to memory of 3956	1188	bc81a8367c9c5970fdfd8b653319d5c86b787f7cf46db0040acfdb3a4e9af602N.exe	83
PID 1188 wrote to memory of 3956	1188	bc81a8367c9c5970fdfd8b653319d5c86b787f7cf46db0040acfdb3a4e9af602N.exe	83
PID 3956 wrote to memory of 1704	3956	omsecor.exe	101
PID 3956 wrote to memory of 1704	3956	omsecor.exe	101
PID 3956 wrote to memory of 1704	3956	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\bc81a8367c9c5970fdfd8b653319d5c86b787f7cf46db0040acfdb3a4e9af602N.exe
"C:\Users\Admin\AppData\Local\Temp\bc81a8367c9c5970fdfd8b653319d5c86b787f7cf46db0040acfdb3a4e9af602N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
972c2168e906b348497a492421618876

SHA1
61982e38caeabf4f567b894e245a6377b5761619

SHA256
eb9a5ddf14a4adb1b7eb0095aac3e6bba473bd97679385e355329632adc22773

SHA512
7ff358104597cf1615758702228ae21cf4008567e4fd01e8770cf830d0d355a5dad54b3063c6e896318f837ed7c053afa86c456971e2a41931dd48e8912a1f80

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
61KB

MD5
c034159d7868adf2b3ca87647c42a050

SHA1
7f890e9e43e4ded539af03e29ca040e4b37054f6

SHA256
28a3642a2e1e6914e8c49ba0d873af6f2f560532ba4d28d88b3fdbffeb89a612

SHA512
02fc2424e1c7b3a34bc0761982839c692ffe3a92e83b1957b8a4f20f93a6f431b3c79a449b02c7830d49a53b7d947d6701617aaea288c612a4fcffe4a954d287

Download Submit