neconyd | 308c56dead16e4a6150d64084db9a4173d6f82676ced5773d4ca9f918a1b15e7

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2024 04:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

308c56dead16e4a6150d64084db9a4173d6f82676ced5773d4ca9f918a1b15e7.exe
Size

80KB
MD5

ce306668b086c19e164f906003b26283
SHA1

7df364972f9f650b360135e39fedcc11db439d56
SHA256

308c56dead16e4a6150d64084db9a4173d6f82676ced5773d4ca9f918a1b15e7
SHA512

8bd137a6a9c46dbe7134fd29af80ba20f32393de2dfae077f01411cb702470004380738bf3d5aafb78f19b301ee8739458b8f4010798d54067064bad155b3fb4
SSDEEP

1536:fd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZcl/52izbR9XwzT:XdseIOMEZEyFjEOFqTiQmOl/5xPvwX

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
3156	omsecor.exe
856	omsecor.exe
1688	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	308c56dead16e4a6150d64084db9a4173d6f82676ced5773d4ca9f918a1b15e7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 3156	4400	308c56dead16e4a6150d64084db9a4173d6f82676ced5773d4ca9f918a1b15e7.exe	82
PID 4400 wrote to memory of 3156	4400	308c56dead16e4a6150d64084db9a4173d6f82676ced5773d4ca9f918a1b15e7.exe	82
PID 4400 wrote to memory of 3156	4400	308c56dead16e4a6150d64084db9a4173d6f82676ced5773d4ca9f918a1b15e7.exe	82
PID 3156 wrote to memory of 856	3156	omsecor.exe	92
PID 3156 wrote to memory of 856	3156	omsecor.exe	92
PID 3156 wrote to memory of 856	3156	omsecor.exe	92
PID 856 wrote to memory of 1688	856	omsecor.exe	93
PID 856 wrote to memory of 1688	856	omsecor.exe	93
PID 856 wrote to memory of 1688	856	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\308c56dead16e4a6150d64084db9a4173d6f82676ced5773d4ca9f918a1b15e7.exe
"C:\Users\Admin\AppData\Local\Temp\308c56dead16e4a6150d64084db9a4173d6f82676ced5773d4ca9f918a1b15e7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
80KB

MD5
ea70b29fd7ffa02e1647ab3cc5560b1e

SHA1
cc45fa261a485666eae78d77118d9d7194c92fb5

SHA256
fa975b98a656dfe82d0cc596bc925eef84931e93bb2d467e7f426d6f0c7ca99b

SHA512
fa014628ba595957d66a6742f61261cf7a6d2a0c0e0f6d07c8595eb3ca180a1412d953c318cb6314a6d96268734a27a5807a0764ef6f9a61f151512058879dbf

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
80KB

MD5
ab0876f72023970f37aa13ba01191a5d

SHA1
ddba8c3c0f610658bed87d075654c38169a5a3f6

SHA256
0675768048178d802e464b91bd2aa740648e750abe4c6ae066501783a0f06c22

SHA512
d0ab00c2897f11a156b637898782a9c2316b80e3d69d10f78b3d1a80a41a99f0902b0ff5603502693dd040c1932ec5cf1b572e571a21ae11573dcc70d0dd655c

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
80KB

MD5
57dc1baa81d04085bd96fd272adcbae5

SHA1
3c795ca255c0692368d72c181cb6861330a31c00

SHA256
7d56ce6fa6f9651f558ea30f140c08a6ef342f058e31535876b97a56d009bad6

SHA512
18d166618c7a2fc6c4a2b3054c0f32ddacf025227a9b3445c0a79209831168cf03799ce147ebc451b99889b3e4833f32872890fb33d68f4f536c7ec040b3c478

Download Submit