neconyd | cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390

Analysis

max time kernel
115s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
01-12-2024 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe
Size

96KB
MD5

41aee7ba2ed1d13c4a4850a14b24f380
SHA1

563f3f4333416ec0701e7ca26e5f7088572e70f5
SHA256

cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390
SHA512

231984c5f4e7563b028afbdc218fc5625ed392b1e2c9a85a11c5587b444bc5ac8b726656a232416550ab00edaf965aa962bbf016cc5034340dbe1257b7f1b156
SSDEEP

1536:QnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxx7:QGs8cd8eXlYairZYqMddH137

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
3000	omsecor.exe
2484	omsecor.exe
1216	omsecor.exe
2164	omsecor.exe
1800	omsecor.exe
3004	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2172	cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe
2172	cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe
3000	omsecor.exe
2484	omsecor.exe
2484	omsecor.exe
2164	omsecor.exe
2164	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2672 set thread context of 2172	2672	cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe	31
PID 3000 set thread context of 2484	3000	omsecor.exe	33
PID 1216 set thread context of 2164	1216	omsecor.exe	36
PID 1800 set thread context of 3004	1800	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2172	2672	cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe	31
PID 2672 wrote to memory of 2172	2672	cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe	31
PID 2672 wrote to memory of 2172	2672	cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe	31
PID 2672 wrote to memory of 2172	2672	cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe	31
PID 2672 wrote to memory of 2172	2672	cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe	31
PID 2672 wrote to memory of 2172	2672	cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe	31
PID 2172 wrote to memory of 3000	2172	cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe	32
PID 2172 wrote to memory of 3000	2172	cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe	32
PID 2172 wrote to memory of 3000	2172	cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe	32
PID 2172 wrote to memory of 3000	2172	cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe	32
PID 3000 wrote to memory of 2484	3000	omsecor.exe	33
PID 3000 wrote to memory of 2484	3000	omsecor.exe	33
PID 3000 wrote to memory of 2484	3000	omsecor.exe	33
PID 3000 wrote to memory of 2484	3000	omsecor.exe	33
PID 3000 wrote to memory of 2484	3000	omsecor.exe	33
PID 3000 wrote to memory of 2484	3000	omsecor.exe	33
PID 2484 wrote to memory of 1216	2484	omsecor.exe	35
PID 2484 wrote to memory of 1216	2484	omsecor.exe	35
PID 2484 wrote to memory of 1216	2484	omsecor.exe	35
PID 2484 wrote to memory of 1216	2484	omsecor.exe	35
PID 1216 wrote to memory of 2164	1216	omsecor.exe	36
PID 1216 wrote to memory of 2164	1216	omsecor.exe	36
PID 1216 wrote to memory of 2164	1216	omsecor.exe	36
PID 1216 wrote to memory of 2164	1216	omsecor.exe	36
PID 1216 wrote to memory of 2164	1216	omsecor.exe	36
PID 1216 wrote to memory of 2164	1216	omsecor.exe	36
PID 2164 wrote to memory of 1800	2164	omsecor.exe	37
PID 2164 wrote to memory of 1800	2164	omsecor.exe	37
PID 2164 wrote to memory of 1800	2164	omsecor.exe	37
PID 2164 wrote to memory of 1800	2164	omsecor.exe	37
PID 1800 wrote to memory of 3004	1800	omsecor.exe	38
PID 1800 wrote to memory of 3004	1800	omsecor.exe	38
PID 1800 wrote to memory of 3004	1800	omsecor.exe	38
PID 1800 wrote to memory of 3004	1800	omsecor.exe	38
PID 1800 wrote to memory of 3004	1800	omsecor.exe	38
PID 1800 wrote to memory of 3004	1800	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe
"C:\Users\Admin\AppData\Local\Temp\cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe
  C:\Users\Admin\AppData\Local\Temp\cea82711c690c0f7609908ff9c2458ab95499dea52f7ff7ff23ed710a39c6390N.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3000
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1216
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
4e8eb77d959d91eaf77aad451418f2dc

SHA1
6079a63b84ee2bc293502db4967b5a3c342e8f63

SHA256
1af3326188f307d899face620b9f4f61f8401e60f0ad8161313713698034c3ba

SHA512
559f0413b364f9598565ce40d6afea650b0326a2ce87650144429eb3ad9e31c44e99caf74f5fa3b478e1b01f77ca232b095808a6dcdad8232e25d447e389c562

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
823bacee2e05b7299278e8d71ac95ae8

SHA1
0697c813db3585a2b90252b52bad190223a3c2e4

SHA256
df0d8209b3e48acf474dbacdb0d6d64840d30cb16dda1c765534efb91f5f4503

SHA512
e9418a6d434e2b200494e16cf0ae0b273fd89c3d0d964b649ba276d315e23c62ed82b63f861cd867bc6c510d5e362d752b4f930988bb70110a3349c5a427a4c6

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
86f6e2a288545cbd6f01a8d5c4713a4e

SHA1
969aa6ebe5b1c658d2dced4dad329bcfd5245c59

SHA256
ac5dfaa68fddd70c1085f79a9d69672e2d72f52cb90688a3ec5bd46173d96aa1

SHA512
87aeedc6786578886b0496f0101a9f0b86758311be90dc06a0249f982f022ea47caa561cd5b3306342d8d6ecdcb4df8b11f5fc31dd194266936a367e4f2a873f

Download Submit
memory/1216-58-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1216-66-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1800-88-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2164-75-0x00000000002B0000-0x00000000002D3000-memory.dmp

Filesize
140KB

Download
memory/2164-73-0x00000000002B0000-0x00000000002D3000-memory.dmp

Filesize
140KB

Download
memory/2172-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2172-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2172-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2172-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2172-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2484-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2484-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2484-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2484-54-0x0000000000440000-0x0000000000463000-memory.dmp

Filesize
140KB

Download
memory/2484-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2484-53-0x0000000000440000-0x0000000000463000-memory.dmp

Filesize
140KB

Download
memory/2484-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2672-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2672-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3000-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3000-24-0x0000000000340000-0x0000000000363000-memory.dmp

Filesize
140KB

Download
memory/3000-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3004-91-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download