neconyd | b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-12-2024 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe
Size

96KB
MD5

522f6ff9d573cb5742ccc0ccf4f93242
SHA1

031d43c1cc38e28e4fbd62d90a59c44a2e77edda
SHA256

b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7
SHA512

51d40f48ea7485543ec382866d42b35806c6f4924686060ca39c4ab5184f0bac9631ab84301c47e3b6b4c0efe8067eaad088b1abdab73909f86d9124275de72f
SSDEEP

1536:PnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:PGs8cd8eXlYairZYqMddH13B

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
1044	omsecor.exe
3068	omsecor.exe
1320	omsecor.exe
2656	omsecor.exe
1912	omsecor.exe
2980	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2916	b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe
2916	b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe
1044	omsecor.exe
3068	omsecor.exe
3068	omsecor.exe
2656	omsecor.exe
2656	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2672 set thread context of 2916	2672	b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe	30
PID 1044 set thread context of 3068	1044	omsecor.exe	32
PID 1320 set thread context of 2656	1320	omsecor.exe	36
PID 1912 set thread context of 2980	1912	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2916	2672	b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe	30
PID 2672 wrote to memory of 2916	2672	b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe	30
PID 2672 wrote to memory of 2916	2672	b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe	30
PID 2672 wrote to memory of 2916	2672	b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe	30
PID 2672 wrote to memory of 2916	2672	b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe	30
PID 2672 wrote to memory of 2916	2672	b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe	30
PID 2916 wrote to memory of 1044	2916	b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe	31
PID 2916 wrote to memory of 1044	2916	b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe	31
PID 2916 wrote to memory of 1044	2916	b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe	31
PID 2916 wrote to memory of 1044	2916	b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe	31
PID 1044 wrote to memory of 3068	1044	omsecor.exe	32
PID 1044 wrote to memory of 3068	1044	omsecor.exe	32
PID 1044 wrote to memory of 3068	1044	omsecor.exe	32
PID 1044 wrote to memory of 3068	1044	omsecor.exe	32
PID 1044 wrote to memory of 3068	1044	omsecor.exe	32
PID 1044 wrote to memory of 3068	1044	omsecor.exe	32
PID 3068 wrote to memory of 1320	3068	omsecor.exe	35
PID 3068 wrote to memory of 1320	3068	omsecor.exe	35
PID 3068 wrote to memory of 1320	3068	omsecor.exe	35
PID 3068 wrote to memory of 1320	3068	omsecor.exe	35
PID 1320 wrote to memory of 2656	1320	omsecor.exe	36
PID 1320 wrote to memory of 2656	1320	omsecor.exe	36
PID 1320 wrote to memory of 2656	1320	omsecor.exe	36
PID 1320 wrote to memory of 2656	1320	omsecor.exe	36
PID 1320 wrote to memory of 2656	1320	omsecor.exe	36
PID 1320 wrote to memory of 2656	1320	omsecor.exe	36
PID 2656 wrote to memory of 1912	2656	omsecor.exe	37
PID 2656 wrote to memory of 1912	2656	omsecor.exe	37
PID 2656 wrote to memory of 1912	2656	omsecor.exe	37
PID 2656 wrote to memory of 1912	2656	omsecor.exe	37
PID 1912 wrote to memory of 2980	1912	omsecor.exe	38
PID 1912 wrote to memory of 2980	1912	omsecor.exe	38
PID 1912 wrote to memory of 2980	1912	omsecor.exe	38
PID 1912 wrote to memory of 2980	1912	omsecor.exe	38
PID 1912 wrote to memory of 2980	1912	omsecor.exe	38
PID 1912 wrote to memory of 2980	1912	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe
"C:\Users\Admin\AppData\Local\Temp\b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe
  C:\Users\Admin\AppData\Local\Temp\b68591eb13ef7d336b16bad1d47bb38774d70c7c2a39cd5cd9777dd91de821e7.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3068
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1320
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
08baf04ca798e06906634f1557df30e3

SHA1
957b70bb7c91c60978425a26547d9cebbc7b6ce0

SHA256
4a67cc0345982af7f9daa1e630aa56bf20e61ad01939dc13abee9b66fd39a2f9

SHA512
d3d5ec0e31c99043215a02d071c3990d7613c4bbf04852372affa5ae75b03f3efad192efbd3feb17f8b53310e0699555b4e9896a8b98e8002579584da49922e8

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
d99c196d3441cfa96b2c4644c0dfeab7

SHA1
47b935e3be0f31d0f1f4936fb503d25362a97390

SHA256
d636b112e70c719dd9451a253e6200d42652759ee97c17bbd7f88f62e2d88a5d

SHA512
879356b23d17802be4f2cd59a0e403e047cd652d35ae3f0a4fd3cb9ba447494c8b5c5eccc0abf7018275284354b94a2c1dea08ef2f0742030cd51683e6da225c

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
4eae2283f7fe3636a45c2635060eab0c

SHA1
20b921c7bcdea76ebfb834e80565eba03371cc4e

SHA256
54df669771e1d2da515300934bfe93ffcc2b03604822bfeb67fd959fddc5bb64

SHA512
9710c735e3eed56175ca7357f6b99b1d682280e2f0f14f8bdc9b839607d5d9280fa7aad10611d69192b93894daa219663047f7f6e6dee13feae5bc0c0c3f5f0b

Download Submit
memory/1044-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1044-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1044-24-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/1320-67-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1320-58-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1912-89-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1912-81-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2656-72-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2672-35-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download
memory/2672-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2672-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2916-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2916-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2916-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2916-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2916-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2980-94-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2980-91-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3068-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3068-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3068-48-0x0000000000390000-0x00000000003B3000-memory.dmp

Filesize
140KB

Download
memory/3068-45-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3068-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3068-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download