neconyd | 6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
Size

96KB
MD5

158413b2b11021b9bf4a91afb0ad9b2f
SHA1

52f3e0859b3f0ecabb68c5cce04d02d5949b05ec
SHA256

6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922
SHA512

5edcd98ec3411677446d0a1356f9fee0952f9da78e30fe5a915c753855225eefcdbfe6f7385a044bf6d003e4aefa1929632cf43f7021e6d6468fb63de2a1ca10
SSDEEP

1536:gnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxJ:gGs8cd8eXlYairZYqMddH13J

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2396	omsecor.exe
2320	omsecor.exe
828	omsecor.exe
1904	omsecor.exe
2256	omsecor.exe
568	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2932	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
2932	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
2396	omsecor.exe
2320	omsecor.exe
2320	omsecor.exe
1904	omsecor.exe
1904	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2532 set thread context of 2932	2532	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	30
PID 2396 set thread context of 2320	2396	omsecor.exe	32
PID 828 set thread context of 1904	828	omsecor.exe	36
PID 2256 set thread context of 568	2256	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2932	2532	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	30
PID 2532 wrote to memory of 2932	2532	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	30
PID 2532 wrote to memory of 2932	2532	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	30
PID 2532 wrote to memory of 2932	2532	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	30
PID 2532 wrote to memory of 2932	2532	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	30
PID 2532 wrote to memory of 2932	2532	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	30
PID 2932 wrote to memory of 2396	2932	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	31
PID 2932 wrote to memory of 2396	2932	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	31
PID 2932 wrote to memory of 2396	2932	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	31
PID 2932 wrote to memory of 2396	2932	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	31
PID 2396 wrote to memory of 2320	2396	omsecor.exe	32
PID 2396 wrote to memory of 2320	2396	omsecor.exe	32
PID 2396 wrote to memory of 2320	2396	omsecor.exe	32
PID 2396 wrote to memory of 2320	2396	omsecor.exe	32
PID 2396 wrote to memory of 2320	2396	omsecor.exe	32
PID 2396 wrote to memory of 2320	2396	omsecor.exe	32
PID 2320 wrote to memory of 828	2320	omsecor.exe	35
PID 2320 wrote to memory of 828	2320	omsecor.exe	35
PID 2320 wrote to memory of 828	2320	omsecor.exe	35
PID 2320 wrote to memory of 828	2320	omsecor.exe	35
PID 828 wrote to memory of 1904	828	omsecor.exe	36
PID 828 wrote to memory of 1904	828	omsecor.exe	36
PID 828 wrote to memory of 1904	828	omsecor.exe	36
PID 828 wrote to memory of 1904	828	omsecor.exe	36
PID 828 wrote to memory of 1904	828	omsecor.exe	36
PID 828 wrote to memory of 1904	828	omsecor.exe	36
PID 1904 wrote to memory of 2256	1904	omsecor.exe	37
PID 1904 wrote to memory of 2256	1904	omsecor.exe	37
PID 1904 wrote to memory of 2256	1904	omsecor.exe	37
PID 1904 wrote to memory of 2256	1904	omsecor.exe	37
PID 2256 wrote to memory of 568	2256	omsecor.exe	38
PID 2256 wrote to memory of 568	2256	omsecor.exe	38
PID 2256 wrote to memory of 568	2256	omsecor.exe	38
PID 2256 wrote to memory of 568	2256	omsecor.exe	38
PID 2256 wrote to memory of 568	2256	omsecor.exe	38
PID 2256 wrote to memory of 568	2256	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
"C:\Users\Admin\AppData\Local\Temp\6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
  C:\Users\Admin\AppData\Local\Temp\6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2320
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:828
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
b3881e5d7d56671fca8f8e05f9610fc8

SHA1
7656dd211adae8be4b0a241a8c7dd9e69e1779be

SHA256
20d297603b8197b0429f5d8b396d733f1bb2084bdfb3743e94514125b7920ebe

SHA512
07bd855da770bffe460296d5a56f02d23930faba6bed9e4f6748cb64083fdb5e71d31ab615b1afa4f24844e318c75523631019d02800fcb64ae277ce2a3a3c8a

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
b9b6e276f2a51716e35c9c7c46ceff28

SHA1
d111a77126abfdd0cbcd15e627b90ed7db7bb4ba

SHA256
f91d39e2dd178db2e47de3ece0202fe0bd3e45143605034b0ea2001346adece6

SHA512
fbee09adac90119625f3f7df115c6ac6c601ae96dc8a3378dbaabe670e541894d4c1dd051153114c213905d0428c1716d47d799a0f7feaedf03eb49cc6c586e7

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
c5dedfc552c51da1cca3533fa3110cbb

SHA1
97d303a88f8bc8f1cc3e4cf0dd80a69c6cc26c54

SHA256
9c66f72791f841f440474a855d970652777ca0f2acc7978e35e2eb2a8333f261

SHA512
be9d45fce43e3667d626677cd54c2831425487336f382b79446d5a91c9c3d19b3c28a967f18cf9e47481b2ec0c39d10085304293d26d70fdaab45dbebe76aabe

Download Submit
memory/568-94-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/568-91-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/828-67-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/828-57-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1904-90-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2256-88-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2256-80-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2320-54-0x0000000000330000-0x0000000000353000-memory.dmp

Filesize
140KB

Download
memory/2320-48-0x0000000000330000-0x0000000000353000-memory.dmp

Filesize
140KB

Download
memory/2320-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2320-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2320-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2320-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2320-58-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2396-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2396-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2532-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2532-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2932-14-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download
memory/2932-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2932-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2932-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2932-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2932-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download