neconyd | 0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 11:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3.exe
Size

64KB
MD5

c44f8b816073ca9d49f324ec821409a5
SHA1

b9c1b7c3558f2614ddc93a797dedf05c4ff02a83
SHA256

0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3
SHA512

3ea7a4174499d147ded7218caa02c7e07a898bd56729ff19d758ba5b63129e2178d4bd0ac0b0ac9b947bbbac87a8c9a839ba5b3e5e7299ffdc9a9519bd0ff83b
SSDEEP

768:bMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uAv:bbIvYvZEyFKF6N4yS+AQmZcl/5H

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
4220	omsecor.exe
952	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 4220	3344	0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3.exe	83
PID 3344 wrote to memory of 4220	3344	0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3.exe	83
PID 3344 wrote to memory of 4220	3344	0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3.exe	83
PID 4220 wrote to memory of 952	4220	omsecor.exe	101
PID 4220 wrote to memory of 952	4220	omsecor.exe	101
PID 4220 wrote to memory of 952	4220	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3.exe
"C:\Users\Admin\AppData\Local\Temp\0c60739d64182b0f0941ab1bde364d2a8ae938e3154373cb96d11a72f664cff3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
64KB

MD5
9eb8c5e012218152a1dbca9fe39e2463

SHA1
2810f85a53291aabb51f533e375c60a885806917

SHA256
f7758f80e8d2b5b2d6d7ddc3bc44026e86dfcf837fc3db6a4ccbf977039a329b

SHA512
029439e1190c65c570d4e942eff5b2198a3d22e2496c78bec25cc88938e138e81dabda3936e098c99e09d8e1ae23a97a61c6ef996c1fc69c448fe033423db721

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
64KB

MD5
443895e489a49921b355c56d3185bd73

SHA1
ce9d44f8b8b6bbad6ccbf1aa57d17b2672000ebc

SHA256
2c87ef8732dc0f8e3052832e84b796de8314d867f466d97d3fef21a26222184e

SHA512
d0c6573ebc50c4f8a9eab6ab9cdb51d6e9b11ce8de9438aba581766653b7ffe677f72165ad526bd7a86a5cf4e2485590061a61896886bf4385a23b4cdc8ae831

Download Submit