neconyd | 6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922

Analysis

max time kernel
148s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
Size

96KB
MD5

158413b2b11021b9bf4a91afb0ad9b2f
SHA1

52f3e0859b3f0ecabb68c5cce04d02d5949b05ec
SHA256

6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922
SHA512

5edcd98ec3411677446d0a1356f9fee0952f9da78e30fe5a915c753855225eefcdbfe6f7385a044bf6d003e4aefa1929632cf43f7021e6d6468fb63de2a1ca10
SSDEEP

1536:gnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxJ:gGs8cd8eXlYairZYqMddH13J

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
1608	omsecor.exe
1384	omsecor.exe
1508	omsecor.exe
2440	omsecor.exe
1068	omsecor.exe
468	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4436 set thread context of 3748	4436	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	82
PID 1608 set thread context of 1384	1608	omsecor.exe	87
PID 1508 set thread context of 2440	1508	omsecor.exe	100
PID 1068 set thread context of 468	1068	omsecor.exe	104

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3648	4436	WerFault.exe	81
4828	1608	WerFault.exe	84
4772	1508	WerFault.exe	99
4236	1068	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 3748	4436	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	82
PID 4436 wrote to memory of 3748	4436	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	82
PID 4436 wrote to memory of 3748	4436	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	82
PID 4436 wrote to memory of 3748	4436	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	82
PID 4436 wrote to memory of 3748	4436	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	82
PID 3748 wrote to memory of 1608	3748	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	84
PID 3748 wrote to memory of 1608	3748	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	84
PID 3748 wrote to memory of 1608	3748	6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe	84
PID 1608 wrote to memory of 1384	1608	omsecor.exe	87
PID 1608 wrote to memory of 1384	1608	omsecor.exe	87
PID 1608 wrote to memory of 1384	1608	omsecor.exe	87
PID 1608 wrote to memory of 1384	1608	omsecor.exe	87
PID 1608 wrote to memory of 1384	1608	omsecor.exe	87
PID 1384 wrote to memory of 1508	1384	omsecor.exe	99
PID 1384 wrote to memory of 1508	1384	omsecor.exe	99
PID 1384 wrote to memory of 1508	1384	omsecor.exe	99
PID 1508 wrote to memory of 2440	1508	omsecor.exe	100
PID 1508 wrote to memory of 2440	1508	omsecor.exe	100
PID 1508 wrote to memory of 2440	1508	omsecor.exe	100
PID 1508 wrote to memory of 2440	1508	omsecor.exe	100
PID 1508 wrote to memory of 2440	1508	omsecor.exe	100
PID 2440 wrote to memory of 1068	2440	omsecor.exe	102
PID 2440 wrote to memory of 1068	2440	omsecor.exe	102
PID 2440 wrote to memory of 1068	2440	omsecor.exe	102
PID 1068 wrote to memory of 468	1068	omsecor.exe	104
PID 1068 wrote to memory of 468	1068	omsecor.exe	104
PID 1068 wrote to memory of 468	1068	omsecor.exe	104
PID 1068 wrote to memory of 468	1068	omsecor.exe	104
PID 1068 wrote to memory of 468	1068	omsecor.exe	104

C:\Users\Admin\AppData\Local\Temp\6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
"C:\Users\Admin\AppData\Local\Temp\6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Users\Admin\AppData\Local\Temp\6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
  C:\Users\Admin\AppData\Local\Temp\6e24460c1117aeec42245ebfd110466135bf3133adf17fb2e3828c7b8bb08922.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1384
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1508
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2440
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1068
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 256
        8⤵
        Program crash
        
        PID:4236
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 292
        6⤵
        Program crash
        
        PID:4772
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 300
      4⤵
      Program crash
      PID:4828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 300
  2⤵
  - Program crash
  PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4436 -ip 4436
1⤵
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1608 -ip 1608
1⤵
PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1508 -ip 1508
1⤵
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1068 -ip 1068
1⤵
PID:3720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
9df596da7a061b5cd7e52ac250f7598d

SHA1
3fe7b1b731420b8ad0d50412d652c22f00fc6534

SHA256
fcd5524f6be74697892da74cf4e28fabc09597070b4764aa7e0702ff861fe1de

SHA512
51770c2da9cca9b14668a69f08d6f4084fc69bcf77ce2259c1f611b4a49689af6967f77a873d15cea696386c1909347c9aa95f7b71b5446ff4fb64b2076ecf73

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
b3881e5d7d56671fca8f8e05f9610fc8

SHA1
7656dd211adae8be4b0a241a8c7dd9e69e1779be

SHA256
20d297603b8197b0429f5d8b396d733f1bb2084bdfb3743e94514125b7920ebe

SHA512
07bd855da770bffe460296d5a56f02d23930faba6bed9e4f6748cb64083fdb5e71d31ab615b1afa4f24844e318c75523631019d02800fcb64ae277ce2a3a3c8a

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
726412abff154ca6f9cdc320810c4150

SHA1
0a60e9b23bdd1796b05f787c554d784e3bf27376

SHA256
237331ce9a8d93a9fac5eafdc210e9ebfe11928ba2fa54de4f94bd6664176494

SHA512
f91aac74adc9d36228500e40778bb68fe1e94f23dd6077f5f6c55c7b466b4638c00bb711644cc1a534de53b28092834d14d4481329fcbd03dd97a42b20ad8377

Download Submit
memory/468-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/468-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/468-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/468-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1068-53-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1068-45-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1384-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1384-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1384-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1384-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1384-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1384-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1384-31-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1508-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1508-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1608-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1608-10-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2440-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2440-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2440-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3748-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3748-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3748-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3748-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4436-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4436-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download