neconyd | db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735

Analysis

max time kernel
114s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe
Size

96KB
MD5

71a35adcb47d08e9879a9d1e96e199b0
SHA1

aa6d1307b61f33132f18a62a47229702baf2652f
SHA256

db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735
SHA512

6a1cc39604093445f2e90f36becee36be7f4a8fa8b8277b5df59dad3105654446e1df0f37256aa302fa7a78f6d2ad54c549d97dddcbb02f994e7df63d203ffd7
SSDEEP

1536:UnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxJ:UGs8cd8eXlYairZYqMddH13J

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2500	omsecor.exe
2888	omsecor.exe
2672	omsecor.exe
2612	omsecor.exe
2668	omsecor.exe
2132	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2472	db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe
2472	db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe
2500	omsecor.exe
2888	omsecor.exe
2888	omsecor.exe
2612	omsecor.exe
2612	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2460 set thread context of 2472	2460	db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe	31
PID 2500 set thread context of 2888	2500	omsecor.exe	33
PID 2672 set thread context of 2612	2672	omsecor.exe	37
PID 2668 set thread context of 2132	2668	omsecor.exe	39

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2472	2460	db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe	31
PID 2460 wrote to memory of 2472	2460	db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe	31
PID 2460 wrote to memory of 2472	2460	db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe	31
PID 2460 wrote to memory of 2472	2460	db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe	31
PID 2460 wrote to memory of 2472	2460	db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe	31
PID 2460 wrote to memory of 2472	2460	db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe	31
PID 2472 wrote to memory of 2500	2472	db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe	32
PID 2472 wrote to memory of 2500	2472	db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe	32
PID 2472 wrote to memory of 2500	2472	db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe	32
PID 2472 wrote to memory of 2500	2472	db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe	32
PID 2500 wrote to memory of 2888	2500	omsecor.exe	33
PID 2500 wrote to memory of 2888	2500	omsecor.exe	33
PID 2500 wrote to memory of 2888	2500	omsecor.exe	33
PID 2500 wrote to memory of 2888	2500	omsecor.exe	33
PID 2500 wrote to memory of 2888	2500	omsecor.exe	33
PID 2500 wrote to memory of 2888	2500	omsecor.exe	33
PID 2888 wrote to memory of 2672	2888	omsecor.exe	36
PID 2888 wrote to memory of 2672	2888	omsecor.exe	36
PID 2888 wrote to memory of 2672	2888	omsecor.exe	36
PID 2888 wrote to memory of 2672	2888	omsecor.exe	36
PID 2672 wrote to memory of 2612	2672	omsecor.exe	37
PID 2672 wrote to memory of 2612	2672	omsecor.exe	37
PID 2672 wrote to memory of 2612	2672	omsecor.exe	37
PID 2672 wrote to memory of 2612	2672	omsecor.exe	37
PID 2672 wrote to memory of 2612	2672	omsecor.exe	37
PID 2672 wrote to memory of 2612	2672	omsecor.exe	37
PID 2612 wrote to memory of 2668	2612	omsecor.exe	38
PID 2612 wrote to memory of 2668	2612	omsecor.exe	38
PID 2612 wrote to memory of 2668	2612	omsecor.exe	38
PID 2612 wrote to memory of 2668	2612	omsecor.exe	38
PID 2668 wrote to memory of 2132	2668	omsecor.exe	39
PID 2668 wrote to memory of 2132	2668	omsecor.exe	39
PID 2668 wrote to memory of 2132	2668	omsecor.exe	39
PID 2668 wrote to memory of 2132	2668	omsecor.exe	39
PID 2668 wrote to memory of 2132	2668	omsecor.exe	39
PID 2668 wrote to memory of 2132	2668	omsecor.exe	39

C:\Users\Admin\AppData\Local\Temp\db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe
"C:\Users\Admin\AppData\Local\Temp\db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Users\Admin\AppData\Local\Temp\db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe
  C:\Users\Admin\AppData\Local\Temp\db5156a7b1f449a6ab9d7225c087ef5785b0c9d4cf4c254a3467330486b3f735N.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2888
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2672
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2612
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2668
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
67c5957647e48283885619ab55646632

SHA1
5e50ce538a8be4a2f95fd853dc048404a09dd070

SHA256
33687d7d3bbfb7aa4ca0ce9c64715ea28d73f47897cce27f477d2589036b78fa

SHA512
3b702617f2c920bbe26f5814df9262c56dc59c52f54e1925153b7174cfc32fbec047742211c84b5f944e059b96ab948159fd895c37be095b47d87ed21152d41b

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
5d03759f00902a5765fe8b106268580d

SHA1
b2163e084ff590e39d9f517d546eca4af2975135

SHA256
66239c848207a8b591099f54c3bfde11f36484b5349f276e4cfbe1e961c37eec

SHA512
a0fe5d24425708ea369e2d800f120f87aae87492bcdb5cd1d04d86a4b1c8f99f4b81f49ea06b22b933df9a837f0d28b734f5c7b7e34583e80db1e722bec045bf

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
db90a8648b0dff4d516161136da607ea

SHA1
4dcb5dab522a73f596d687e7bc88c7e51faf517e

SHA256
a276e8269f51d79c91c20d2e0d105ec4227fd0b8cc8b07b688057e0b2cd2e290

SHA512
2ea91d890c7868d3f1ce40000db45f3f69621ce041d62411f6ed276bcc7d0389c6b4a1b4bfa734d2e8818e407a86030035bad1fac454913ab4db24318e513955

Download Submit
memory/2132-89-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2460-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2460-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2472-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2472-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2472-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2472-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2472-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2500-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2500-24-0x00000000002C0000-0x00000000002E3000-memory.dmp

Filesize
140KB

Download
memory/2500-34-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2612-72-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download
memory/2668-87-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2672-66-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2888-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2888-54-0x0000000000320000-0x0000000000343000-memory.dmp

Filesize
140KB

Download
memory/2888-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2888-47-0x0000000000320000-0x0000000000343000-memory.dmp

Filesize
140KB

Download
memory/2888-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2888-41-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2888-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download