neconyd | 0f7ddef1bcaaa0b84d0b37d68a45b02344918ceecafbe04ad5b576227b639d62

Analysis

max time kernel
116s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f7ddef1bcaaa0b84d0b37d68a45b02344918ceecafbe04ad5b576227b639d62N.exe
Size

71KB
MD5

94aea223130dc03520e4f3f93d4a1c50
SHA1

036bb0e6d5abe906cb35d83594396fe9b402853f
SHA256

0f7ddef1bcaaa0b84d0b37d68a45b02344918ceecafbe04ad5b576227b639d62
SHA512

c1f5dad0a1a3707295f125b795df6b24acf130b4835ae252b79b98d657145c72824d2ecf8364c265e831d48a0f11a667dea330e74a9e3a944ad06f293eb1eea2
SSDEEP

1536:hd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH:RdseIOMEZEyFjEOFqTiQmQDHIbH

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
3976	omsecor.exe
2096	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f7ddef1bcaaa0b84d0b37d68a45b02344918ceecafbe04ad5b576227b639d62N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 3976	4128	0f7ddef1bcaaa0b84d0b37d68a45b02344918ceecafbe04ad5b576227b639d62N.exe	82
PID 4128 wrote to memory of 3976	4128	0f7ddef1bcaaa0b84d0b37d68a45b02344918ceecafbe04ad5b576227b639d62N.exe	82
PID 4128 wrote to memory of 3976	4128	0f7ddef1bcaaa0b84d0b37d68a45b02344918ceecafbe04ad5b576227b639d62N.exe	82
PID 3976 wrote to memory of 2096	3976	omsecor.exe	92
PID 3976 wrote to memory of 2096	3976	omsecor.exe	92
PID 3976 wrote to memory of 2096	3976	omsecor.exe	92

C:\Users\Admin\AppData\Local\Temp\0f7ddef1bcaaa0b84d0b37d68a45b02344918ceecafbe04ad5b576227b639d62N.exe
"C:\Users\Admin\AppData\Local\Temp\0f7ddef1bcaaa0b84d0b37d68a45b02344918ceecafbe04ad5b576227b639d62N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
71KB

MD5
79da934e20fc8e0fd1a6702d84be72bd

SHA1
d008aa20495cd782e5842c73be7c92f5949b60bc

SHA256
ee45e38ca785db1d7399621bb936257cc194119542495720e190a8ccc364faec

SHA512
319f5509a4a959ca1f07ea5210a51b42ff409eb90e028d69a87298059bb5a06d3224af0456e41a9dbdd9807a781ad4c04b608a25f0f93c73a6f20ee5845e4a95

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
71KB

MD5
2aec396d6053b939a740530ae08c82f7

SHA1
55f061d9863915ee955d6ca873d6bb9484224735

SHA256
a08c4bec38cc02d38c28ea89abd56298ead12287f83030bddba9e46427dac96c

SHA512
c3ed59174f930c03da0e930c3d2bdcafd76ae9339e57e251c2bb4be505cbd84aabd3b35083032074516b629a163eb7e5566aefa15de6ec68430a145ebca6f83f

Download Submit
memory/2096-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2096-14-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3976-5-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3976-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3976-12-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4128-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4128-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download