neconyd | e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf.exe
Size

84KB
MD5

c394bcf1e6699c7f12c929964d80dbbd
SHA1

b2c7dd720e7d03e56bb5764e5c446cf6d97ed7ce
SHA256

e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf
SHA512

e5695803cce0aa43a15fc083cacf741253b980cfb54c5f89d16c547b72e414365336971f3ca16a8f523cf2e92f8e40f7e030ab98084b86f0b5fc5cb371402ef1
SSDEEP

768:LMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAd:LbIvYvZEyFKF6N4yS+AQmZTl/5F

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
1148	omsecor.exe
2956	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 1148	4724	e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf.exe	82
PID 4724 wrote to memory of 1148	4724	e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf.exe	82
PID 4724 wrote to memory of 1148	4724	e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf.exe	82
PID 1148 wrote to memory of 2956	1148	omsecor.exe	92
PID 1148 wrote to memory of 2956	1148	omsecor.exe	92
PID 1148 wrote to memory of 2956	1148	omsecor.exe	92

C:\Users\Admin\AppData\Local\Temp\e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf.exe
"C:\Users\Admin\AppData\Local\Temp\e839b5540bda37fd55d467dbb081b909f827b0ed85b3f551559d3ae802b279cf.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
84KB

MD5
cd7e14257103e44b9c9584856e2daf9f

SHA1
a7e459f2fe03570359097073b194c5e555492256

SHA256
9634b47020e5ded8ed29819ab6428bc9e180780c03883f8d7a6bbd65fb72a149

SHA512
73e67568951d41e2347b5fba95b57db25e120ef027c299ec04f33be874ba4d49169e2a5678bdf8589b5b553357e7b5de5a915780c48590195f73e17a0a655e38

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
84KB

MD5
9f48f03561a6978036c3de9a718573cf

SHA1
1463fb7b9b2ee9617a3994fb8f2955edee21f7c0

SHA256
ed5ded08eaa6bb1164d74e107d98c2d9e72f21dc269b58a6833351ee9d860710

SHA512
2e8d83d6b6f0fe10461311f32e80a08c0ec87e314074d3203eca56b3dc254cc1e2fb82b74b37745fa15c29595fe34f18512bf5ad80ed282abe5b231daa516281

Download Submit