neconyd | 32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/12/2024, 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe
Size

61KB
MD5

13ebb36e596146a672c3ff8b6e08c2d4
SHA1

b2309079bdbd23463c4f60f962494b2888e5452c
SHA256

32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad
SHA512

c9cf11d45bbd98d883069c9dcf681cc3bfe34d791809f59c1ab6a6fee6cbffe1648c3d6aebdfc028d0398990e7a4719682c0edf7c8890448c27160d2f8557c18
SSDEEP

1536:Qd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZxl/5:QdseIOMEZEyFjEOFqTiQmTl/5

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
3872	omsecor.exe
3236	omsecor.exe
2360	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 3872	428	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe	83
PID 428 wrote to memory of 3872	428	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe	83
PID 428 wrote to memory of 3872	428	32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe	83
PID 3872 wrote to memory of 3236	3872	omsecor.exe	100
PID 3872 wrote to memory of 3236	3872	omsecor.exe	100
PID 3872 wrote to memory of 3236	3872	omsecor.exe	100
PID 3236 wrote to memory of 2360	3236	omsecor.exe	101
PID 3236 wrote to memory of 2360	3236	omsecor.exe	101
PID 3236 wrote to memory of 2360	3236	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe
"C:\Users\Admin\AppData\Local\Temp\32f2a8dc6d14dffc3df5f6382a579e27e5df7d522f31a03ae902b3e360c525ad.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:428
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
c4c8d2854c336208bd4e0d74b598ad0a

SHA1
c9921fec23ddd9bcd373f585e1d1933aeba08c41

SHA256
963b8bf99e3a82d6152d620d7e606792f9411de3c00bfa41b30a87405af787be

SHA512
c4c29b75da5634af17cf912ba39f44895382c74372307554878f822c32e41084f0792b5f1a7ac48a7fb76369ede11ab7b8cd4cebc6b749de88d80b4214bab995

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
61KB

MD5
1e8eef8662afbdc724d0566f3912e83c

SHA1
bf7d5bc6a5d60cafd771afb6e8cfad7630774945

SHA256
322f3b6b964a07bbe67dce324b3dfa23b8d85e84e208ffcd38b0b8946ce5e520

SHA512
6a1d3d2415997b266c12a90e3ef133f21e3d05affa4159dd407b8cfa8030b576ca612a51a05f2e27d097783b9aa3b83a6495d74c0234c8cf16d47a1d8a6522fc

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
61KB

MD5
1cf10315a3e2e2636db6d256ef89f2d7

SHA1
d0435f1c03fde4fb3675a6b6ffee54a04ffb70af

SHA256
81017c858c4a7f556eb192992a4e401dadbcaa1da3d2805405be1ba128dad26b

SHA512
70afb9096dd703f590537c4adc3b09b18b34d2b87ee022356f6428f0924062fe941aaaaa120bccfabcb16c54e36ba2ea07b15b5f15d97e8422560fa9f631327f

Download Submit