neconyd | c5323486c94dae16219f49efa62cd2edb9c1aa400812e888d2a714561c8ec5bc

Analysis

max time kernel
114s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5323486c94dae16219f49efa62cd2edb9c1aa400812e888d2a714561c8ec5bcN.exe
Size

3.2MB
MD5

4024a4b521b031f48811ad3db5c442d0
SHA1

5be742f35b9656428c0a4138394675fa730cad98
SHA256

c5323486c94dae16219f49efa62cd2edb9c1aa400812e888d2a714561c8ec5bc
SHA512

ac2e8b3601f7062caa52dca1bff6957ae74051cffe1f3177d2c946a024df3e0a9f3eb372bddedbd99c60a18d8f7b321a918034dce5502dcbcd5138fc6edae017
SSDEEP

24576:ZOsfW+/6oTFwh3Qh3YZrxEu8CL7W2Y7TjtWDlp5DB5:M6W+TFq6IZj8N2Y7T5GFr

Score

10^/10

neconyd discovery trojan

Malware Config

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
2936	omsecor.exe
4932	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5323486c94dae16219f49efa62cd2edb9c1aa400812e888d2a714561c8ec5bcN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 2936	3292	c5323486c94dae16219f49efa62cd2edb9c1aa400812e888d2a714561c8ec5bcN.exe	83
PID 3292 wrote to memory of 2936	3292	c5323486c94dae16219f49efa62cd2edb9c1aa400812e888d2a714561c8ec5bcN.exe	83
PID 3292 wrote to memory of 2936	3292	c5323486c94dae16219f49efa62cd2edb9c1aa400812e888d2a714561c8ec5bcN.exe	83
PID 2936 wrote to memory of 4932	2936	omsecor.exe	100
PID 2936 wrote to memory of 4932	2936	omsecor.exe	100
PID 2936 wrote to memory of 4932	2936	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\c5323486c94dae16219f49efa62cd2edb9c1aa400812e888d2a714561c8ec5bcN.exe
"C:\Users\Admin\AppData\Local\Temp\c5323486c94dae16219f49efa62cd2edb9c1aa400812e888d2a714561c8ec5bcN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
3.2MB

MD5
767faf9f0a320d7e6e844dda05add0ab

SHA1
ef5f0c160d3f1c70bc10027b17d188c0173e29a4

SHA256
f500d0924796684e1eb19fb191cd51a4a30de4b43d31ae129d3ee623638406c2

SHA512
4d3eb4fe13ad706364f7de85a8ce93fcf2c438d6e9d89cca94c53f53b56b9c5dc439dd5fb7bae72977eeb86a234ed3b1cf328e3b3e4d907eba1abec7acae73cf

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
3.2MB

MD5
11ad91a448577443b9be78e7f9266ef7

SHA1
83b6866624b5efec65d80d4c93d979908e810ae1

SHA256
71f7dfbbcc037df9fa32548229c5608391241951a4c30247647790dae1ed3cc1

SHA512
cf45c3451a8f8f1a2c515bba456d6f7e56bc3cca632e0a259acbb7e76259ffcf4165a912090b2e29f720e16192c9c6bc53ee31a31432a7fdd24bcf08ebb318b9

Download Submit