neconyd | ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737

Analysis

max time kernel
115s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2024 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737.exe
Size

90KB
MD5

7febbbf1966e907f2d6a1bf15eae6bde
SHA1

94b861a98d91c5190cfa6c2b2ae03f707fe075a3
SHA256

ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737
SHA512

da866cf120eda097044694800ec09faec6fc248abb3a97dc11d665a6ac3ef75eb3445b8d7928d6dfd79f46923e4c38f2da9288377007210223c27081b71e59ae
SSDEEP

768:NMEIvFGvZEr8LFK0ic46N4zeSdPAHwmZGp6JXXlaa5uAe:NbIvYvZEyFKF6N4aS5AQmZTl/52

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
448	omsecor.exe
3036	omsecor.exe
404	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 448	3260	ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737.exe	85
PID 3260 wrote to memory of 448	3260	ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737.exe	85
PID 3260 wrote to memory of 448	3260	ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737.exe	85
PID 448 wrote to memory of 3036	448	omsecor.exe	104
PID 448 wrote to memory of 3036	448	omsecor.exe	104
PID 448 wrote to memory of 3036	448	omsecor.exe	104
PID 3036 wrote to memory of 404	3036	omsecor.exe	105
PID 3036 wrote to memory of 404	3036	omsecor.exe	105
PID 3036 wrote to memory of 404	3036	omsecor.exe	105

C:\Users\Admin\AppData\Local\Temp\ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737.exe
"C:\Users\Admin\AppData\Local\Temp\ccab41d7ee381f80668f53c9dbf43fa136898239c2018e8782629349b2ce5737.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
90KB

MD5
90f44711cbceab58039be1cd4537d266

SHA1
b7bed232ebbf9571cd1d1db254a481cd116cb298

SHA256
1fce2223e39211234ca035e71b31f10bc729433cf5670ca9367da4fb82922ab8

SHA512
b37fb4990fff5d8ce9ea9d93f0df3e72a4f58c658cca90727d236390b0268f06576f439afcf0bc955c3f116b4aa5c458631cece5ac1290c4ebdc827c2ccdb68d

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
90KB

MD5
1d1cc92b1f0251c2c8476fe0f54df325

SHA1
a10dd01c60c05097d464f3db92549a8c1e7936ff

SHA256
63b9c400bd44b31c38a19cdc4e053b20a7e7c3b4b191168f2e37b581c004a927

SHA512
f39746c5441fa46276a70ac454e5bd25724819feec8b9b1112c0e41e3124c8463d64a52c1b2f69305d07990f6ede4293961c2fa22f00b49312280691aa5694b0

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
90KB

MD5
f3fd28d60d0e386f5a35c2a18a7a696c

SHA1
8458ea20303737b7916a95a4195850773ca36330

SHA256
bee34a5d641adba2f29e23ae19a1c06cd1159b2fd2a96f24167346c8a7246631

SHA512
039ecb934fb4419ba68d123a0bfb77536adb5fb9ad2d704a05491dc4e6803c9d326e06848771fd793abe218b0bc915b53a7ead04bcfe55f0ebc80774257cfdf8

Download Submit
memory/404-18-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/404-20-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/448-5-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/448-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/448-12-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3036-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3036-17-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3260-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3260-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download