neconyd | ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/12/2024, 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe
Size

96KB
MD5

99ca5d0619fad80b91b8db48c0816d89
SHA1

917ea111c1ec1d8974d6833556bfc15e23ca0f68
SHA256

ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23
SHA512

014ade3f395ec2160f62a30d9771e953f661bce89feaa6a6a297771534096e57189ee0956940d07b12887146da8a89f4d336c2f8d2839a7527112199dc556891
SSDEEP

1536:bnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:bGs8cd8eXlYairZYqMddH13B

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2716	omsecor.exe
2184	omsecor.exe
328	omsecor.exe
1688	omsecor.exe
3056	omsecor.exe
2492	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2028	ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe
2028	ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe
2716	omsecor.exe
2184	omsecor.exe
2184	omsecor.exe
1688	omsecor.exe
1688	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2076 set thread context of 2028	2076	ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe	30
PID 2716 set thread context of 2184	2716	omsecor.exe	32
PID 328 set thread context of 1688	328	omsecor.exe	36
PID 3056 set thread context of 2492	3056	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2028	2076	ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe	30
PID 2076 wrote to memory of 2028	2076	ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe	30
PID 2076 wrote to memory of 2028	2076	ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe	30
PID 2076 wrote to memory of 2028	2076	ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe	30
PID 2076 wrote to memory of 2028	2076	ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe	30
PID 2076 wrote to memory of 2028	2076	ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe	30
PID 2028 wrote to memory of 2716	2028	ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe	31
PID 2028 wrote to memory of 2716	2028	ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe	31
PID 2028 wrote to memory of 2716	2028	ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe	31
PID 2028 wrote to memory of 2716	2028	ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe	31
PID 2716 wrote to memory of 2184	2716	omsecor.exe	32
PID 2716 wrote to memory of 2184	2716	omsecor.exe	32
PID 2716 wrote to memory of 2184	2716	omsecor.exe	32
PID 2716 wrote to memory of 2184	2716	omsecor.exe	32
PID 2716 wrote to memory of 2184	2716	omsecor.exe	32
PID 2716 wrote to memory of 2184	2716	omsecor.exe	32
PID 2184 wrote to memory of 328	2184	omsecor.exe	35
PID 2184 wrote to memory of 328	2184	omsecor.exe	35
PID 2184 wrote to memory of 328	2184	omsecor.exe	35
PID 2184 wrote to memory of 328	2184	omsecor.exe	35
PID 328 wrote to memory of 1688	328	omsecor.exe	36
PID 328 wrote to memory of 1688	328	omsecor.exe	36
PID 328 wrote to memory of 1688	328	omsecor.exe	36
PID 328 wrote to memory of 1688	328	omsecor.exe	36
PID 328 wrote to memory of 1688	328	omsecor.exe	36
PID 328 wrote to memory of 1688	328	omsecor.exe	36
PID 1688 wrote to memory of 3056	1688	omsecor.exe	37
PID 1688 wrote to memory of 3056	1688	omsecor.exe	37
PID 1688 wrote to memory of 3056	1688	omsecor.exe	37
PID 1688 wrote to memory of 3056	1688	omsecor.exe	37
PID 3056 wrote to memory of 2492	3056	omsecor.exe	38
PID 3056 wrote to memory of 2492	3056	omsecor.exe	38
PID 3056 wrote to memory of 2492	3056	omsecor.exe	38
PID 3056 wrote to memory of 2492	3056	omsecor.exe	38
PID 3056 wrote to memory of 2492	3056	omsecor.exe	38
PID 3056 wrote to memory of 2492	3056	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe
"C:\Users\Admin\AppData\Local\Temp\ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe
  C:\Users\Admin\AppData\Local\Temp\ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2184
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:328
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1688
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
0b68407d1d3ebead4c0c0ec47a2deebe

SHA1
6e4d47ec6c8851212d678a3d07ab5b34cac9a75d

SHA256
d6dddf93e564fd10026c2449df9ae0bab7dfc2e33063281b07a6b09ed10f561a

SHA512
dda5f7c3801703b6d2a59dab44d27bdb1ef524e6390e74738e5cccae9eda4fb2ce7a6559e1769b12558569698395a8cf11b47f81a1724b457fec2c9873af44b0

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
617505153420e7dc5f138ed8362128a4

SHA1
f9596bff282a24681dcc8623ecdb13c0222f4690

SHA256
03d9cb0a5e007765c383c53ac5c205c713d182606e0221d9f3067ef1328f1edc

SHA512
7c08f86e1cfdab381e649d26f32e4829323d974af329e923cfe39338e9494ac83c6a74efae4cc9656962bd8d7db6b71adec1cd0697f5a586f46fb6069d35fc20

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
1873104195d575bc486d66fb766ab1ca

SHA1
c2051a4e3d705bbc9b4f5ca6d138df03918ee3f8

SHA256
f7dbb88dfc3b977a542416b8b868e9f93605c7d191baefa0280698f2a8c6ae09

SHA512
ac5a7abca5b080ce2a49623fb36af98799113e6753c9ff5ac0ef955ca061fa0c1d9d155114ff23918dc298b1dd5fc1e8bc2902e2eee21dd7535b5260322027cc

Download Submit
memory/328-58-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/328-68-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1688-73-0x0000000000430000-0x0000000000453000-memory.dmp

Filesize
140KB

Download
memory/2028-6-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2028-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2028-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2028-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2028-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2076-11-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2076-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2076-1-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/2184-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2184-45-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2184-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2184-48-0x00000000002B0000-0x00000000002D3000-memory.dmp

Filesize
140KB

Download
memory/2184-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2184-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2492-91-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2492-94-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2716-34-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download
memory/2716-33-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2716-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3056-81-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3056-89-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download