neconyd | 2a83b0d1152365d0fd981deae59c384e950119abd9f53bb2d854c6628e8e94a3

Analysis

max time kernel
114s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2024, 06:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a83b0d1152365d0fd981deae59c384e950119abd9f53bb2d854c6628e8e94a3N.exe
Size

61KB
MD5

78bbed686fcb6e7e69a4a260ccbaf890
SHA1

252b382498bac37f7e877f1cee13ba0c456bb75e
SHA256

2a83b0d1152365d0fd981deae59c384e950119abd9f53bb2d854c6628e8e94a3
SHA512

ecb4509aa420776c0d00b43a9a4fc53c5e3206aa44263038c8ad070e6692f74703f7ac6fabcef14ca10e7d0237c9d300a996a6d5b67e70509e54c41d2de7bc41
SSDEEP

1536:ld9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZ4l/5P:NdseIOMEZEyFjEOFqTiQmil/5P

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
4436	omsecor.exe
4676	omsecor.exe
2832	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a83b0d1152365d0fd981deae59c384e950119abd9f53bb2d854c6628e8e94a3N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 4436	4544	2a83b0d1152365d0fd981deae59c384e950119abd9f53bb2d854c6628e8e94a3N.exe	82
PID 4544 wrote to memory of 4436	4544	2a83b0d1152365d0fd981deae59c384e950119abd9f53bb2d854c6628e8e94a3N.exe	82
PID 4544 wrote to memory of 4436	4544	2a83b0d1152365d0fd981deae59c384e950119abd9f53bb2d854c6628e8e94a3N.exe	82
PID 4436 wrote to memory of 4676	4436	omsecor.exe	92
PID 4436 wrote to memory of 4676	4436	omsecor.exe	92
PID 4436 wrote to memory of 4676	4436	omsecor.exe	92
PID 4676 wrote to memory of 2832	4676	omsecor.exe	93
PID 4676 wrote to memory of 2832	4676	omsecor.exe	93
PID 4676 wrote to memory of 2832	4676	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\2a83b0d1152365d0fd981deae59c384e950119abd9f53bb2d854c6628e8e94a3N.exe
"C:\Users\Admin\AppData\Local\Temp\2a83b0d1152365d0fd981deae59c384e950119abd9f53bb2d854c6628e8e94a3N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
2353da4ecfb785aaca7fb7de76fd17d2

SHA1
000c5bb6a02f09c366aa305b8e0c69bf724bc2c5

SHA256
97b3128f25a95a929326542710f4b7e9f88a86306630ac276026e56015599519

SHA512
a130ae36f1e0f513a07705a69790995136611e9054f2941f96188b470c0d09554019bb730b1a2727911d1b6b5813ff92b7d20a1da9011e56bad8d8ccc99742ed

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
4325126f6d792ff83075f7c6980d5813

SHA1
6b113c9db65e88c639b211bc811c4bfa3e4b2099

SHA256
2c638ab8ac8a2a2e7a1e6b054cc20f8b78138ed1ad4920419cf36de61966344b

SHA512
12d14351abff1d83d82beb36f7a1f8641711c3adf53bd7d11e2f2931ba132ac6d24705a9147dc842c9c15be288a30096be975f356687ce1fb3ee16d339e6842c

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
61KB

MD5
fec3c3f4d35cbadcf5083a4d1dfdb59a

SHA1
86766b120d60daf6cb83a93ebd51a9d7b30e2c9e

SHA256
d152c4b3100f094af340fbefd14a23a9b9d4fdfde5238e364e3ec87823103e0c

SHA512
c4a360d9ac9f8fe5fa4afabf2cdb1638f35a817a21b08f83ebde07ab2412b682f1ef4a2059484a2695a847c68000e41809b112f427767c1d0361a16c8d6e35ca

Download Submit