neconyd | 6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922

Analysis

max time kernel
115s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
Size

96KB
MD5

158413b2b11021b9bf4a91afb0ad9b2f
SHA1

52f3e0859b3f0ecabb68c5cce04d02d5949b05ec
SHA256

6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922
SHA512

5edcd98ec3411677446d0a1356f9fee0952f9da78e30fe5a915c753855225eefcdbfe6f7385a044bf6d003e4aefa1929632cf43f7021e6d6468fb63de2a1ca10
SSDEEP

1536:gnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxJ:gGs8cd8eXlYairZYqMddH13J

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2052	omsecor.exe
4452	omsecor.exe
1696	omsecor.exe
4384	omsecor.exe
1256	omsecor.exe
4592	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2588 set thread context of 3076	2588	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	82
PID 2052 set thread context of 4452	2052	omsecor.exe	87
PID 1696 set thread context of 4384	1696	omsecor.exe	100
PID 1256 set thread context of 4592	1256	omsecor.exe	103

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2660	2588	WerFault.exe	81
4664	2052	WerFault.exe	85
2796	1696	WerFault.exe	99
3744	1256	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 3076	2588	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	82
PID 2588 wrote to memory of 3076	2588	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	82
PID 2588 wrote to memory of 3076	2588	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	82
PID 2588 wrote to memory of 3076	2588	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	82
PID 2588 wrote to memory of 3076	2588	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	82
PID 3076 wrote to memory of 2052	3076	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	85
PID 3076 wrote to memory of 2052	3076	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	85
PID 3076 wrote to memory of 2052	3076	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	85
PID 2052 wrote to memory of 4452	2052	omsecor.exe	87
PID 2052 wrote to memory of 4452	2052	omsecor.exe	87
PID 2052 wrote to memory of 4452	2052	omsecor.exe	87
PID 2052 wrote to memory of 4452	2052	omsecor.exe	87
PID 2052 wrote to memory of 4452	2052	omsecor.exe	87
PID 4452 wrote to memory of 1696	4452	omsecor.exe	99
PID 4452 wrote to memory of 1696	4452	omsecor.exe	99
PID 4452 wrote to memory of 1696	4452	omsecor.exe	99
PID 1696 wrote to memory of 4384	1696	omsecor.exe	100
PID 1696 wrote to memory of 4384	1696	omsecor.exe	100
PID 1696 wrote to memory of 4384	1696	omsecor.exe	100
PID 1696 wrote to memory of 4384	1696	omsecor.exe	100
PID 1696 wrote to memory of 4384	1696	omsecor.exe	100
PID 4384 wrote to memory of 1256	4384	omsecor.exe	102
PID 4384 wrote to memory of 1256	4384	omsecor.exe	102
PID 4384 wrote to memory of 1256	4384	omsecor.exe	102
PID 1256 wrote to memory of 4592	1256	omsecor.exe	103
PID 1256 wrote to memory of 4592	1256	omsecor.exe	103
PID 1256 wrote to memory of 4592	1256	omsecor.exe	103
PID 1256 wrote to memory of 4592	1256	omsecor.exe	103
PID 1256 wrote to memory of 4592	1256	omsecor.exe	103

C:\Users\Admin\AppData\Local\Temp\6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
"C:\Users\Admin\AppData\Local\Temp\6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Local\Temp\6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
  C:\Users\Admin\AppData\Local\Temp\6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4452
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1696
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1256
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 268
        8⤵
        Program crash
        
        PID:3744
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 292
        6⤵
        Program crash
        
        PID:2796
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 288
      4⤵
      Program crash
      PID:4664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 288
  2⤵
  - Program crash
  PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2588 -ip 2588
1⤵
PID:760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2052 -ip 2052
1⤵
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1696 -ip 1696
1⤵
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1256 -ip 1256
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
6e1ed608f8e1b83831c7a306a650f9bd

SHA1
ad34336a785e2ddf58e26a14fdc97643058f5c9d

SHA256
1f5bdb8e3bab286046d70404c2d91f57e4dc6267e01e719363019f2a80ea7996

SHA512
81edf7279d7807d71f49954f7a56a6daeaf1027bc3c13392c36c282c99a45c4fe4803f4630b2454a161127a3bb176403f935cc0b9f5d2193673535de66168efa

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
b3881e5d7d56671fca8f8e05f9610fc8

SHA1
7656dd211adae8be4b0a241a8c7dd9e69e1779be

SHA256
20d297603b8197b0429f5d8b396d733f1bb2084bdfb3743e94514125b7920ebe

SHA512
07bd855da770bffe460296d5a56f02d23930faba6bed9e4f6748cb64083fdb5e71d31ab615b1afa4f24844e318c75523631019d02800fcb64ae277ce2a3a3c8a

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
2bfa0c70b0d08085ee180519d2708aaa

SHA1
bfec75e06c5f981ff056e33436302d137a2c2348

SHA256
656c2285bcc3f9493a8f24bbaa226c71c0b2665f6d92070504be48897c563660

SHA512
304eade6b2570a2bbbecdef772bb10c40d90d465d73d0e49a84338d04c31f8f8e76248d9e11022401d4509503cf368552e55c91e5cce2b14481b614962ad0af2

Download Submit
memory/1256-46-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1696-35-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2052-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2052-9-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2588-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2588-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3076-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3076-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3076-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3076-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4452-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4452-34-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4452-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4452-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4452-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4452-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4452-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4592-51-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4592-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4592-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download