neconyd | 936dbadef8ec653ecd3da381fa4b4a0c4f2a17c03b88d96d93a3da72a833f9c0

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

936dbadef8ec653ecd3da381fa4b4a0c4f2a17c03b88d96d93a3da72a833f9c0N.exe
Size

76KB
MD5

4ca384ece866884af75be9817b493e80
SHA1

ec44e7ed30e89185da606e3b25e76d0311cfc511
SHA256

936dbadef8ec653ecd3da381fa4b4a0c4f2a17c03b88d96d93a3da72a833f9c0
SHA512

be09410f1a20a77e45ccb1eeba08517ab6869bbe79a51dc7c0c2c3c63b097b372d0fda5ed558fe5b3119d273e21d6210bb4e168dbcbc7a1bdfb18b6d223739ca
SSDEEP

1536:Ed9dseIOcE93NIvYvZEyFhEEOF6N4yS+AQmZTl/5s11:8dseIOKEZEyF6EOFqTiQm5l/5s11

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
4868	omsecor.exe
3080	omsecor.exe
1640	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	936dbadef8ec653ecd3da381fa4b4a0c4f2a17c03b88d96d93a3da72a833f9c0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 4868	3104	936dbadef8ec653ecd3da381fa4b4a0c4f2a17c03b88d96d93a3da72a833f9c0N.exe	83
PID 3104 wrote to memory of 4868	3104	936dbadef8ec653ecd3da381fa4b4a0c4f2a17c03b88d96d93a3da72a833f9c0N.exe	83
PID 3104 wrote to memory of 4868	3104	936dbadef8ec653ecd3da381fa4b4a0c4f2a17c03b88d96d93a3da72a833f9c0N.exe	83
PID 4868 wrote to memory of 3080	4868	omsecor.exe	100
PID 4868 wrote to memory of 3080	4868	omsecor.exe	100
PID 4868 wrote to memory of 3080	4868	omsecor.exe	100
PID 3080 wrote to memory of 1640	3080	omsecor.exe	101
PID 3080 wrote to memory of 1640	3080	omsecor.exe	101
PID 3080 wrote to memory of 1640	3080	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\936dbadef8ec653ecd3da381fa4b4a0c4f2a17c03b88d96d93a3da72a833f9c0N.exe
"C:\Users\Admin\AppData\Local\Temp\936dbadef8ec653ecd3da381fa4b4a0c4f2a17c03b88d96d93a3da72a833f9c0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
5e6faabcd9498d9df5bcab5e5e325fff

SHA1
f1fadfb84fd198b794e0e1757cccbabb3bee5f29

SHA256
ba45b800798d239feff895bdd86600a0178fd979fc14506cde4154ad9e8d5290

SHA512
f9151dc971e77e0a390bcf8627eacc81c67625e31297428ab005b0f3cc97b46c1deb15585e9289fafe4a47a510ee1a78769dff2a22b98c0db95eb2fe9328b543

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
9ce960cd451c14dcd370b58c32fc1b58

SHA1
46de93f65d42f6c069c090e1aee790ea8b1ce24a

SHA256
4230b812e1f39aebd0931411d41eaede236673a3168eb67e522ee9f84a9e1a80

SHA512
7689320081d01e29f5c411005bd7056ecdda1e311953f54fed3b4d55900ef35c2d6aebecc9578d70959a4bd0503b8224377a48a8a383208aa937a6cd0b2f4d46

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
76KB

MD5
74622ce811a157ab0440a1ddf7651bd9

SHA1
cc7e1126792b1db9e5cca5cc9f3ac0e889c37bd5

SHA256
fe7fce35642b529fca8c3f83a65141e2c54864fbe6994fcd7a66f226ca8d6f1e

SHA512
16ff0f8a6ab1a11da828e353ec3a11a12301ec03efc3be4c79fda2802216c21dda2f51cdfd90d8c6c5c9e5bd628c8d0ab136bd635bf3bbb562f997c125efcb8a

Download Submit
memory/1640-18-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1640-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3080-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3080-17-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3104-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3104-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4868-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4868-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4868-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download