neconyd | 2f389fe09084ed8bf74ad0079e35c88b1153b47b98933343a168fb2ba47d3aaa

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2024 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f389fe09084ed8bf74ad0079e35c88b1153b47b98933343a168fb2ba47d3aaa.exe
Size

65KB
MD5

8df38148e28d61e6c99b6b180011b90c
SHA1

aefad4eb4e35f609a8f15b83c317f194391c3f5f
SHA256

2f389fe09084ed8bf74ad0079e35c88b1153b47b98933343a168fb2ba47d3aaa
SHA512

7af505b30a751f821adaaf57c456d548860c0f4d63e9559eea35cfcacf3e426a440aa8057f48ef936c79c16e952bc930c99e72d7f59b2a8c48d85e354393396e
SSDEEP

1536:Wd9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZ/Hz:udseIO+EZEyFjEOFqTiQmRHz

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
1284	omsecor.exe
4456	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f389fe09084ed8bf74ad0079e35c88b1153b47b98933343a168fb2ba47d3aaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 1284	4804	2f389fe09084ed8bf74ad0079e35c88b1153b47b98933343a168fb2ba47d3aaa.exe	83
PID 4804 wrote to memory of 1284	4804	2f389fe09084ed8bf74ad0079e35c88b1153b47b98933343a168fb2ba47d3aaa.exe	83
PID 4804 wrote to memory of 1284	4804	2f389fe09084ed8bf74ad0079e35c88b1153b47b98933343a168fb2ba47d3aaa.exe	83
PID 1284 wrote to memory of 4456	1284	omsecor.exe	101
PID 1284 wrote to memory of 4456	1284	omsecor.exe	101
PID 1284 wrote to memory of 4456	1284	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\2f389fe09084ed8bf74ad0079e35c88b1153b47b98933343a168fb2ba47d3aaa.exe
"C:\Users\Admin\AppData\Local\Temp\2f389fe09084ed8bf74ad0079e35c88b1153b47b98933343a168fb2ba47d3aaa.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:4456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
65KB

MD5
0249fb0c91f0a071bd998cdb392b9787

SHA1
ad9e0cd8e5ebf830b31f936ccec6075b970cf37b

SHA256
a76d5a62fb8a5e6d63ce2502ad43d458c260bbac823a7973c6763fd7255579b8

SHA512
2261cb35b46ebe8e8313c3b24bbb1d48e73ee587bae6a2cf1fc49d0aefa55e6943f36e48843945545573d45e068c2791468c316b69bb8610d842f2806c0c1a27

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
65KB

MD5
e083e4652c59c59e56ebf7485493113a

SHA1
8df8ec085997d0bc917cfd548ff38f0316b98a29

SHA256
ec8069f1bf21427ca01dd91dc1f96da276be138c9724b8d544d3b0eb19807967

SHA512
ea0a4ad22df826947c7ffb52090f4c19050fd8110312a2a13d7159fdc7d1c379899a9120cde179fd579501da43d0d2c6ec67745b5d7cb66069eb7aefdfcb4b15

Download Submit
memory/1284-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1284-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1284-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4456-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4456-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4804-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4804-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download