neconyd | 58142ba5242844324d015b2aadd965e79518a07a8334f7b9cbc7739cce323627

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58142ba5242844324d015b2aadd965e79518a07a8334f7b9cbc7739cce323627.exe
Size

61KB
MD5

71b167567fdf671e6fd71b304f079546
SHA1

66114cf4a991b64ee59c92d61715e17c31346ff7
SHA256

58142ba5242844324d015b2aadd965e79518a07a8334f7b9cbc7739cce323627
SHA512

7ee29435a37d96ee19ab36be00fc54dcc0c12c60c4897790b092bc5d6ac1ea70fe507cb436df1e5dc003a4c4ac69141f89c1eb83e601e55a4e01acc02a0e5103
SSDEEP

1536:ld9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZ4l/5H:NdseIOMEZEyFjEOFqTiQmil/5H

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
1028	omsecor.exe
2120	omsecor.exe

Loads dropped DLL 4 IoCs

pid	Process
2092	58142ba5242844324d015b2aadd965e79518a07a8334f7b9cbc7739cce323627.exe
2092	58142ba5242844324d015b2aadd965e79518a07a8334f7b9cbc7739cce323627.exe
1028	omsecor.exe
1028	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58142ba5242844324d015b2aadd965e79518a07a8334f7b9cbc7739cce323627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 1028	2092	58142ba5242844324d015b2aadd965e79518a07a8334f7b9cbc7739cce323627.exe	30
PID 2092 wrote to memory of 1028	2092	58142ba5242844324d015b2aadd965e79518a07a8334f7b9cbc7739cce323627.exe	30
PID 2092 wrote to memory of 1028	2092	58142ba5242844324d015b2aadd965e79518a07a8334f7b9cbc7739cce323627.exe	30
PID 2092 wrote to memory of 1028	2092	58142ba5242844324d015b2aadd965e79518a07a8334f7b9cbc7739cce323627.exe	30
PID 1028 wrote to memory of 2120	1028	omsecor.exe	33
PID 1028 wrote to memory of 2120	1028	omsecor.exe	33
PID 1028 wrote to memory of 2120	1028	omsecor.exe	33
PID 1028 wrote to memory of 2120	1028	omsecor.exe	33

C:\Users\Admin\AppData\Local\Temp\58142ba5242844324d015b2aadd965e79518a07a8334f7b9cbc7739cce323627.exe
"C:\Users\Admin\AppData\Local\Temp\58142ba5242844324d015b2aadd965e79518a07a8334f7b9cbc7739cce323627.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
192fba3f7edbb1cfa9cd1bb82bc05e4a

SHA1
be9476e110c28486a5b3fcd032af7a33d37a0474

SHA256
4a59b855948d2c54244c1500480283711a557aaaff1008cec4ce012b38436d3b

SHA512
834abcb13d1113d419bf3489cdaa6aa6362febdcc0fc9aff8b4dff326760ccfab193764c9c1e2c4af15a9042a0562193bdeac5c9b3ce145c8cc70dca93cfac0e

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
61KB

MD5
066053eb87db520e3c2a83a89a57b9a8

SHA1
9e759d3dfe3dad2599e2c3839706c5f33008cf4f

SHA256
d7c1f7413c869d5ab2a2dd3e80d11b2386a38be7400bd3987cc8d62004a051a8

SHA512
26124f0be07785e7c9b5b62c1b67bf2c8d316256d1c022a234f4add5b88ce4ac907c9e04038c2f57b58903258529a35e996402ce7658ed9a7a625b469ad6c51d

Download Submit