neconyd | dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-12-2024 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe
Size

96KB
MD5

168cc088b9275fac6fa9e812180340a6
SHA1

9a820b3ed0f490524a68062586c28a427886c5e0
SHA256

dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2
SHA512

9b2ba200bac64e4d80c1de7b8ca42102acae3fc80bc486283316d9c5c6e2b2ee5220e08065ed0acaaac38d9aa555c67846ab480d6bef2bf502200cb1f74de62b
SSDEEP

1536:anAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxx7:aGs8cd8eXlYairZYqMddH137

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2668	omsecor.exe
2704	omsecor.exe
1372	omsecor.exe
716	omsecor.exe
1748	omsecor.exe
2900	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2760	dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe
2760	dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe
2668	omsecor.exe
2704	omsecor.exe
2704	omsecor.exe
716	omsecor.exe
716	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3052 set thread context of 2760	3052	dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe	31
PID 2668 set thread context of 2704	2668	omsecor.exe	33
PID 1372 set thread context of 716	1372	omsecor.exe	36
PID 1748 set thread context of 2900	1748	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2760	3052	dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe	31
PID 3052 wrote to memory of 2760	3052	dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe	31
PID 3052 wrote to memory of 2760	3052	dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe	31
PID 3052 wrote to memory of 2760	3052	dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe	31
PID 3052 wrote to memory of 2760	3052	dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe	31
PID 3052 wrote to memory of 2760	3052	dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe	31
PID 2760 wrote to memory of 2668	2760	dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe	32
PID 2760 wrote to memory of 2668	2760	dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe	32
PID 2760 wrote to memory of 2668	2760	dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe	32
PID 2760 wrote to memory of 2668	2760	dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe	32
PID 2668 wrote to memory of 2704	2668	omsecor.exe	33
PID 2668 wrote to memory of 2704	2668	omsecor.exe	33
PID 2668 wrote to memory of 2704	2668	omsecor.exe	33
PID 2668 wrote to memory of 2704	2668	omsecor.exe	33
PID 2668 wrote to memory of 2704	2668	omsecor.exe	33
PID 2668 wrote to memory of 2704	2668	omsecor.exe	33
PID 2704 wrote to memory of 1372	2704	omsecor.exe	35
PID 2704 wrote to memory of 1372	2704	omsecor.exe	35
PID 2704 wrote to memory of 1372	2704	omsecor.exe	35
PID 2704 wrote to memory of 1372	2704	omsecor.exe	35
PID 1372 wrote to memory of 716	1372	omsecor.exe	36
PID 1372 wrote to memory of 716	1372	omsecor.exe	36
PID 1372 wrote to memory of 716	1372	omsecor.exe	36
PID 1372 wrote to memory of 716	1372	omsecor.exe	36
PID 1372 wrote to memory of 716	1372	omsecor.exe	36
PID 1372 wrote to memory of 716	1372	omsecor.exe	36
PID 716 wrote to memory of 1748	716	omsecor.exe	37
PID 716 wrote to memory of 1748	716	omsecor.exe	37
PID 716 wrote to memory of 1748	716	omsecor.exe	37
PID 716 wrote to memory of 1748	716	omsecor.exe	37
PID 1748 wrote to memory of 2900	1748	omsecor.exe	38
PID 1748 wrote to memory of 2900	1748	omsecor.exe	38
PID 1748 wrote to memory of 2900	1748	omsecor.exe	38
PID 1748 wrote to memory of 2900	1748	omsecor.exe	38
PID 1748 wrote to memory of 2900	1748	omsecor.exe	38
PID 1748 wrote to memory of 2900	1748	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe
"C:\Users\Admin\AppData\Local\Temp\dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe
  C:\Users\Admin\AppData\Local\Temp\dd80e6636cb15c19b702230f488dfca96f1d63ca7a171124de70f607d11a00f2.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1372
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:716
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
0a341dfc21966f2a7ffb09aa55e26334

SHA1
716ee97783219b260bfc6a111fcda44e71e19288

SHA256
f468aa938a63a3bd5fbcb50baf588a9c2b0f29c558c61115f83ffd7f607c639d

SHA512
4ee2fc871762eb73036395e53c8a4e1a442a51e957008c77647ebe1ff0fa366dca08aec51a5d474aab930379a69b87c1f2e20162aadf9053cbfcd5a5392495dd

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
5a68aceb0e5d7f696ec8d42884efa11a

SHA1
62a3b9fcf76a41557a9ceb2463e76d9d5603b3ac

SHA256
fdfe1e1a1a1d072fa1a33203f2b34c576c01bd662e91203da0939caf1456a2b0

SHA512
6eb571bc3b61a6a0243c6b724ed4c2ee34a597cb99b9dea667eccf31a5503e743ca140c17cecdfa720851278a4b4590ff6c25b56713719b1b77343e63be95673

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
57c43cdcc6c24d51fca6f5ece833dcaa

SHA1
980571a79500dc80fee7142258f4d2649b56de1e

SHA256
463a0a2211eab34adf14288ee27afe8241208bfaff9cf1b02c8ea756bcf21da6

SHA512
89a805bec95e5e388c7fa147f44775712df133d5d0c8242e3ef4a12ee841f84cf6c4d2147f59f3356296ee40b64681b37eb7be2b1bad3f4aa3552fad4e5f16e6

Download Submit
memory/716-76-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/716-78-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/1372-57-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1372-66-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1748-89-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1748-81-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2668-34-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2668-25-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2668-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2704-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2704-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2704-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2704-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2704-45-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2760-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2760-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2760-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2760-6-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2760-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2900-91-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2900-94-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3052-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3052-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3052-1-0x00000000002B0000-0x00000000002D3000-memory.dmp

Filesize
140KB

Download