neconyd | 6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
Size

96KB
MD5

158413b2b11021b9bf4a91afb0ad9b2f
SHA1

52f3e0859b3f0ecabb68c5cce04d02d5949b05ec
SHA256

6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922
SHA512

5edcd98ec3411677446d0a1356f9fee0952f9da78e30fe5a915c753855225eefcdbfe6f7385a044bf6d003e4aefa1929632cf43f7021e6d6468fb63de2a1ca10
SSDEEP

1536:gnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxJ:gGs8cd8eXlYairZYqMddH13J

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2392	omsecor.exe
2064	omsecor.exe
2848	omsecor.exe
2844	omsecor.exe
2956	omsecor.exe
2296	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2552	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
2552	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
2392	omsecor.exe
2064	omsecor.exe
2064	omsecor.exe
2844	omsecor.exe
2844	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2072 set thread context of 2552	2072	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	31
PID 2392 set thread context of 2064	2392	omsecor.exe	33
PID 2848 set thread context of 2844	2848	omsecor.exe	37
PID 2956 set thread context of 2296	2956	omsecor.exe	39

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2552	2072	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	31
PID 2072 wrote to memory of 2552	2072	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	31
PID 2072 wrote to memory of 2552	2072	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	31
PID 2072 wrote to memory of 2552	2072	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	31
PID 2072 wrote to memory of 2552	2072	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	31
PID 2072 wrote to memory of 2552	2072	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	31
PID 2552 wrote to memory of 2392	2552	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	32
PID 2552 wrote to memory of 2392	2552	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	32
PID 2552 wrote to memory of 2392	2552	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	32
PID 2552 wrote to memory of 2392	2552	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	32
PID 2392 wrote to memory of 2064	2392	omsecor.exe	33
PID 2392 wrote to memory of 2064	2392	omsecor.exe	33
PID 2392 wrote to memory of 2064	2392	omsecor.exe	33
PID 2392 wrote to memory of 2064	2392	omsecor.exe	33
PID 2392 wrote to memory of 2064	2392	omsecor.exe	33
PID 2392 wrote to memory of 2064	2392	omsecor.exe	33
PID 2064 wrote to memory of 2848	2064	omsecor.exe	36
PID 2064 wrote to memory of 2848	2064	omsecor.exe	36
PID 2064 wrote to memory of 2848	2064	omsecor.exe	36
PID 2064 wrote to memory of 2848	2064	omsecor.exe	36
PID 2848 wrote to memory of 2844	2848	omsecor.exe	37
PID 2848 wrote to memory of 2844	2848	omsecor.exe	37
PID 2848 wrote to memory of 2844	2848	omsecor.exe	37
PID 2848 wrote to memory of 2844	2848	omsecor.exe	37
PID 2848 wrote to memory of 2844	2848	omsecor.exe	37
PID 2848 wrote to memory of 2844	2848	omsecor.exe	37
PID 2844 wrote to memory of 2956	2844	omsecor.exe	38
PID 2844 wrote to memory of 2956	2844	omsecor.exe	38
PID 2844 wrote to memory of 2956	2844	omsecor.exe	38
PID 2844 wrote to memory of 2956	2844	omsecor.exe	38
PID 2956 wrote to memory of 2296	2956	omsecor.exe	39
PID 2956 wrote to memory of 2296	2956	omsecor.exe	39
PID 2956 wrote to memory of 2296	2956	omsecor.exe	39
PID 2956 wrote to memory of 2296	2956	omsecor.exe	39
PID 2956 wrote to memory of 2296	2956	omsecor.exe	39
PID 2956 wrote to memory of 2296	2956	omsecor.exe	39

C:\Users\Admin\AppData\Local\Temp\6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
"C:\Users\Admin\AppData\Local\Temp\6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
  C:\Users\Admin\AppData\Local\Temp\6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2064
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2848
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
b3881e5d7d56671fca8f8e05f9610fc8

SHA1
7656dd211adae8be4b0a241a8c7dd9e69e1779be

SHA256
20d297603b8197b0429f5d8b396d733f1bb2084bdfb3743e94514125b7920ebe

SHA512
07bd855da770bffe460296d5a56f02d23930faba6bed9e4f6748cb64083fdb5e71d31ab615b1afa4f24844e318c75523631019d02800fcb64ae277ce2a3a3c8a

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
daf62d5bd1ca3a86e89b9879d9c071ff

SHA1
063faec7fcd6f8cc27d94432b77392ae621f4dd7

SHA256
3428c2fd96872d14133b59c1912a1c6e05f0f854ad7013edf0a56677dc441a60

SHA512
6544a727310f16e8aad2a84291e4a9fb6f5d2b7cca1fab54bfb74bf1ddf9077086de38630ac33129c462b9369b43bf0b6b364d7b214539befb8e6919c869022f

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
f95d23cd614a4554a5dbffe8d2471b67

SHA1
4e0d0934db7edee744b8d1e5ea0c106cb35689ba

SHA256
6332ae3997da4cd3f13258c7d0f90e76c503b3650cb76633eaac830ba216535e

SHA512
ee99fd68fbdef7809d1dbf309eccb0d39f1d932f5d70519535dfa459ed0c975875e8b2ab2963488baaf26b3a1c0fbba03a271da013b6dcc4af6e1e402b24cbe0

Download Submit
memory/2064-46-0x0000000000780000-0x00000000007A3000-memory.dmp

Filesize
140KB

Download
memory/2064-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2064-43-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2064-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2064-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2064-34-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2072-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2072-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2296-88-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2392-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2392-30-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2552-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2552-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2552-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2552-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2552-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2844-69-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2844-78-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2848-63-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2956-85-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download