neconyd | c6711b9998b392e82c64841ef31154282cc62fd173bee302ca405f2f8ff0cfa3

Analysis

max time kernel
114s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6711b9998b392e82c64841ef31154282cc62fd173bee302ca405f2f8ff0cfa3N.exe
Size

90KB
MD5

808e84c3e8ced5af5a9620129c63fb90
SHA1

e46d20dbe4f78d79ca0314049b40e4782d115a0d
SHA256

c6711b9998b392e82c64841ef31154282cc62fd173bee302ca405f2f8ff0cfa3
SHA512

0910a9d172ffeb44e02a19408599e699729aac27b60842f4346a0e0f50d81aca326cdc4ead6924069fb17927904bcb5b563457400e0bd164ab2139b7a61b1ee9
SSDEEP

768:PMEIvFGvZEr8LFK0ic46N4zeSdPAHwmZGp6JXXlaa5uA6:PbIvYvZEyFKF6N4aS5AQmZTl/5C

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
3252	omsecor.exe
4352	omsecor.exe
4104	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c6711b9998b392e82c64841ef31154282cc62fd173bee302ca405f2f8ff0cfa3N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 3252	864	c6711b9998b392e82c64841ef31154282cc62fd173bee302ca405f2f8ff0cfa3N.exe	82
PID 864 wrote to memory of 3252	864	c6711b9998b392e82c64841ef31154282cc62fd173bee302ca405f2f8ff0cfa3N.exe	82
PID 864 wrote to memory of 3252	864	c6711b9998b392e82c64841ef31154282cc62fd173bee302ca405f2f8ff0cfa3N.exe	82
PID 3252 wrote to memory of 4352	3252	omsecor.exe	92
PID 3252 wrote to memory of 4352	3252	omsecor.exe	92
PID 3252 wrote to memory of 4352	3252	omsecor.exe	92
PID 4352 wrote to memory of 4104	4352	omsecor.exe	93
PID 4352 wrote to memory of 4104	4352	omsecor.exe	93
PID 4352 wrote to memory of 4104	4352	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\c6711b9998b392e82c64841ef31154282cc62fd173bee302ca405f2f8ff0cfa3N.exe
"C:\Users\Admin\AppData\Local\Temp\c6711b9998b392e82c64841ef31154282cc62fd173bee302ca405f2f8ff0cfa3N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:864
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
90KB

MD5
17e9a929df409e941a54f7954061dfe3

SHA1
4a47f4a99340ecd6e5487052faa3e780ee9d8ba2

SHA256
5b1268e3366ad97928fcc142837c8e08c8658259a207176de705baabc4751aba

SHA512
968dabbc69ddcefafa615a6a0fd9e67d9da98ac1b660f6484fffe9aee1b295e14ed9c8ccdbab7bd8fc23324a1ab3242c9e98fd4e87d3885adf2f83047a35e07c

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
90KB

MD5
69b1799635d184250302de6597aa3761

SHA1
e88601011de7ca65a5aecca0c38355b8dced4d72

SHA256
d2bee53d89fafd2601a789bec29fdd5157fa8447099da26c6b5c7c32c51dacaf

SHA512
8749747774ab97dc92ba12a810c9f28c5dbb3af2c7651aa2e5c524857befe4bfbb11bdb5c604b36a9c78554e6d206e01b6333d2efe17f7087c3233de1194ba0c

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
90KB

MD5
84f53cd7e72633ce243561ad871f0481

SHA1
aa2e43f9661058dbc2db110f3ce77eb366651b84

SHA256
41ceb488c5bea0e90518c8cb7cc14834c2064eaeb4bee020eaaa61e47da72c56

SHA512
821df3476da91e50d08b4d86fcb8aeec1b9a794171e83c51656fb5295aff1f1bb985da803a28818e3b47046171f4c30111c07af620e4519951ddbdb979908a6c

Download Submit
memory/864-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/864-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3252-4-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3252-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3252-13-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4104-18-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4104-20-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4352-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4352-16-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download