neconyd | 5a48bf56e56ba18384194e64d420c0b6a503725330f2a4e22484c498097fa0f1

Analysis

max time kernel
114s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a48bf56e56ba18384194e64d420c0b6a503725330f2a4e22484c498097fa0f1N.exe
Size

90KB
MD5

80c678b33a6d6ed0ea43720bbdc93810
SHA1

356656500dba7784f0e640bedf95d548c5373e08
SHA256

5a48bf56e56ba18384194e64d420c0b6a503725330f2a4e22484c498097fa0f1
SHA512

8f4252a87dd44373e07a18d8acd0b635f30ccf50c2775c24222b9d6c8618700188dcba212421172bfc8bb0be1364d077bf5838242c646e6928acbc96f8aeea8d
SSDEEP

768:uMEIvFGvZEr8LFK0ic46N4zeSdPAHwmZGp6JXXlaa5uA:ubIvYvZEyFKF6N4aS5AQmZTl/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2232	omsecor.exe
1940	omsecor.exe
4448	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a48bf56e56ba18384194e64d420c0b6a503725330f2a4e22484c498097fa0f1N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 2232	3996	5a48bf56e56ba18384194e64d420c0b6a503725330f2a4e22484c498097fa0f1N.exe	83
PID 3996 wrote to memory of 2232	3996	5a48bf56e56ba18384194e64d420c0b6a503725330f2a4e22484c498097fa0f1N.exe	83
PID 3996 wrote to memory of 2232	3996	5a48bf56e56ba18384194e64d420c0b6a503725330f2a4e22484c498097fa0f1N.exe	83
PID 2232 wrote to memory of 1940	2232	omsecor.exe	101
PID 2232 wrote to memory of 1940	2232	omsecor.exe	101
PID 2232 wrote to memory of 1940	2232	omsecor.exe	101
PID 1940 wrote to memory of 4448	1940	omsecor.exe	102
PID 1940 wrote to memory of 4448	1940	omsecor.exe	102
PID 1940 wrote to memory of 4448	1940	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\5a48bf56e56ba18384194e64d420c0b6a503725330f2a4e22484c498097fa0f1N.exe
"C:\Users\Admin\AppData\Local\Temp\5a48bf56e56ba18384194e64d420c0b6a503725330f2a4e22484c498097fa0f1N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
90KB

MD5
1104170b74ea00f67fdf1c0800e29565

SHA1
ffab5f33920d9cb300ee5ea23dfb85cff5c127a7

SHA256
41418bd0ac3a1eca570979d2a2779bd0daefdaa6c37b49e9e70c4d42d125c50c

SHA512
2836dfc2737d403460dda59dfe47c55776663e3c751fbeca7e830c9c6afdf40522a4f0e31ea33b3b41e7cd18e843c1c6f677b1aa2479d76c5319f00590ad1c01

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
90KB

MD5
c46cf5bde28c03671f3b8f3f73980467

SHA1
217a1ef4d70c70e8d59d714439e910e34c2504d6

SHA256
4924cb63b36c6fa1e659b3544c70c2e8f054b38220e7d21551e7c2191af7111b

SHA512
29c8cfaf462b7500a59e0cd04269ffc6d010866e9e421ce3e9a22061d38625750b59510ed5df0fb6adcfcb02461ef131f0d0905271912e423a71233a9f409965

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
90KB

MD5
fe59e4258472ebe5c3558e92b0c00302

SHA1
4c8f909b883e54d8bc141b9b276f2c6b7c23e949

SHA256
48a3706cf2bcaba6068430c22c326d1a2ff81b63117ac4cc5dba1023265980cb

SHA512
00e57b28d07f71096113652c5bee1f65c7bd39c9ee486c6f296007c14b846a6bd696058135fa25eaf298d83a2217c44a351f1b6e4a04fcbaa200612d929237f6

Download Submit
memory/1940-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1940-17-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2232-4-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2232-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2232-12-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3996-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3996-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4448-18-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4448-20-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download