neconyd | 674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db.exe
Size

96KB
MD5

0b3b42bff5540bd1d729343bf6c84a34
SHA1

de07110e79b27a4e4f5835009ceae477170d9365
SHA256

674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db
SHA512

7a68f9b93cfc117da0af0ecc9c6c4423456d2e9f7c5fee6194715bfbd2ca9d767d03ee0f761883585226e9cc4b1a4a192aec56e43e807ce317f33f61257bedcc
SSDEEP

1536:OnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxu:OGs8cd8eXlYairZYqMddH13u

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
764	omsecor.exe
1692	omsecor.exe
1660	omsecor.exe
1092	omsecor.exe
4404	omsecor.exe
3588	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5048 set thread context of 3652	5048	674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db.exe	82
PID 764 set thread context of 1692	764	omsecor.exe	86
PID 1660 set thread context of 1092	1660	omsecor.exe	100
PID 4404 set thread context of 3588	4404	omsecor.exe	104

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4864	5048	WerFault.exe	81
3896	764	WerFault.exe	84
1996	1660	WerFault.exe	99
2240	4404	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 3652	5048	674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db.exe	82
PID 5048 wrote to memory of 3652	5048	674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db.exe	82
PID 5048 wrote to memory of 3652	5048	674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db.exe	82
PID 5048 wrote to memory of 3652	5048	674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db.exe	82
PID 5048 wrote to memory of 3652	5048	674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db.exe	82
PID 3652 wrote to memory of 764	3652	674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db.exe	84
PID 3652 wrote to memory of 764	3652	674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db.exe	84
PID 3652 wrote to memory of 764	3652	674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db.exe	84
PID 764 wrote to memory of 1692	764	omsecor.exe	86
PID 764 wrote to memory of 1692	764	omsecor.exe	86
PID 764 wrote to memory of 1692	764	omsecor.exe	86
PID 764 wrote to memory of 1692	764	omsecor.exe	86
PID 764 wrote to memory of 1692	764	omsecor.exe	86
PID 1692 wrote to memory of 1660	1692	omsecor.exe	99
PID 1692 wrote to memory of 1660	1692	omsecor.exe	99
PID 1692 wrote to memory of 1660	1692	omsecor.exe	99
PID 1660 wrote to memory of 1092	1660	omsecor.exe	100
PID 1660 wrote to memory of 1092	1660	omsecor.exe	100
PID 1660 wrote to memory of 1092	1660	omsecor.exe	100
PID 1660 wrote to memory of 1092	1660	omsecor.exe	100
PID 1660 wrote to memory of 1092	1660	omsecor.exe	100
PID 1092 wrote to memory of 4404	1092	omsecor.exe	102
PID 1092 wrote to memory of 4404	1092	omsecor.exe	102
PID 1092 wrote to memory of 4404	1092	omsecor.exe	102
PID 4404 wrote to memory of 3588	4404	omsecor.exe	104
PID 4404 wrote to memory of 3588	4404	omsecor.exe	104
PID 4404 wrote to memory of 3588	4404	omsecor.exe	104
PID 4404 wrote to memory of 3588	4404	omsecor.exe	104
PID 4404 wrote to memory of 3588	4404	omsecor.exe	104

C:\Users\Admin\AppData\Local\Temp\674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db.exe
"C:\Users\Admin\AppData\Local\Temp\674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db.exe
  C:\Users\Admin\AppData\Local\Temp\674d56b5c25bb2e2d2bdaf44f626e6be22f1a8be941011a0b078488126cf46db.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1692
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1660
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1092
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 268
        8⤵
        Program crash
        
        PID:2240
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 292
        6⤵
        Program crash
        
        PID:1996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 300
      4⤵
      Program crash
      PID:3896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 288
  2⤵
  - Program crash
  PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5048 -ip 5048
1⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 764 -ip 764
1⤵
PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1660 -ip 1660
1⤵
PID:380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4404 -ip 4404
1⤵
PID:3428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
32f0874b6045cb13e526dc4c5915788a

SHA1
b5651ada18c8d5e48f5fb83a8728c77cb2383dcf

SHA256
1f7ff81d1e16dc2db475b2b465a80e83ac2306a45e4ce5a159b18ed1c59144ed

SHA512
d6be2a2a629058b890dab444c2e13018aa63ba6a9eb231520ffbfc56935735275271d1019351668a43165562a57f29e5552a122374baf1893389a9532dd6eaa5

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
a883e66e82d27f731b577451263f7238

SHA1
8b97b4315de2a96c4183b6b70783b81b9cf029ce

SHA256
1170e65620295e7e7ebaf3189c04fc6f3ec575054b6e00228e0fa75a46e042d1

SHA512
9f0ae8e32713b4ae1e171c6bb58e1f3ebaafa1e8454d880442f86d0b736ef6ac459be3edf873f5f8f6e04c333dd12ea90d043949680d8bb92ea842750b017b59

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
4e881482efd8f84cb566ab0fb30dcf79

SHA1
4505df58e591bcacdc501ed134e493e8c5eb0ae0

SHA256
521fc7fa35c87cc46b58b2246c9d67d02b96c05eb609f9839526ceb27aa173a9

SHA512
c348fad6829cf1598108b11b35893bb38ce0c72a52804321d40dd3c416d3afaf816bef8014865818aba85244baf06a9e75f1061d69929d806358a7bcca2800bc

Download Submit
memory/764-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/764-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1092-43-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1092-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1092-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1660-54-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1660-36-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1692-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1692-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1692-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1692-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1692-28-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1692-34-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1692-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3588-51-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3588-52-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3588-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3588-59-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3652-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3652-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3652-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3652-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4404-47-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4404-55-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/5048-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/5048-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download