neconyd | 15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2024 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe
Size

134KB
MD5

eb3d3b17e41c40cbae73072b9d9a1a7d
SHA1

7c0feef921da8f9d08a476d64afcd55a4bf02726
SHA256

15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d
SHA512

0820ee2bfb04115354be88347bb000ab4d97d65551a64d04f62740d841e663506cb40f4e6eeb1b76ad1650c64d2f1a7d63fc8618083fcdccd725fe4096e293b7
SSDEEP

1536:8DfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCi1:iiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
3508	omsecor.exe
3332	omsecor.exe
836	omsecor.exe
1188	omsecor.exe
4404	omsecor.exe
3512	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2916 set thread context of 1540	2916	15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe	84
PID 3508 set thread context of 3332	3508	omsecor.exe	89
PID 836 set thread context of 1188	836	omsecor.exe	111
PID 4404 set thread context of 3512	4404	omsecor.exe	115

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1460	2916	WerFault.exe	83
3228	3508	WerFault.exe	86
4544	836	WerFault.exe	110
3012	4404	WerFault.exe	113

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 1540	2916	15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe	84
PID 2916 wrote to memory of 1540	2916	15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe	84
PID 2916 wrote to memory of 1540	2916	15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe	84
PID 2916 wrote to memory of 1540	2916	15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe	84
PID 2916 wrote to memory of 1540	2916	15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe	84
PID 1540 wrote to memory of 3508	1540	15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe	86
PID 1540 wrote to memory of 3508	1540	15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe	86
PID 1540 wrote to memory of 3508	1540	15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe	86
PID 3508 wrote to memory of 3332	3508	omsecor.exe	89
PID 3508 wrote to memory of 3332	3508	omsecor.exe	89
PID 3508 wrote to memory of 3332	3508	omsecor.exe	89
PID 3508 wrote to memory of 3332	3508	omsecor.exe	89
PID 3508 wrote to memory of 3332	3508	omsecor.exe	89
PID 3332 wrote to memory of 836	3332	omsecor.exe	110
PID 3332 wrote to memory of 836	3332	omsecor.exe	110
PID 3332 wrote to memory of 836	3332	omsecor.exe	110
PID 836 wrote to memory of 1188	836	omsecor.exe	111
PID 836 wrote to memory of 1188	836	omsecor.exe	111
PID 836 wrote to memory of 1188	836	omsecor.exe	111
PID 836 wrote to memory of 1188	836	omsecor.exe	111
PID 836 wrote to memory of 1188	836	omsecor.exe	111
PID 1188 wrote to memory of 4404	1188	omsecor.exe	113
PID 1188 wrote to memory of 4404	1188	omsecor.exe	113
PID 1188 wrote to memory of 4404	1188	omsecor.exe	113
PID 4404 wrote to memory of 3512	4404	omsecor.exe	115
PID 4404 wrote to memory of 3512	4404	omsecor.exe	115
PID 4404 wrote to memory of 3512	4404	omsecor.exe	115
PID 4404 wrote to memory of 3512	4404	omsecor.exe	115
PID 4404 wrote to memory of 3512	4404	omsecor.exe	115

C:\Users\Admin\AppData\Local\Temp\15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe
"C:\Users\Admin\AppData\Local\Temp\15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe
  C:\Users\Admin\AppData\Local\Temp\15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3332
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:836
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 252
        8⤵
        Program crash
        
        PID:3012
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 292
        6⤵
        Program crash
        
        PID:4544
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 300
      4⤵
      Program crash
      PID:3228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 272
  2⤵
  - Program crash
  PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2916 -ip 2916
1⤵
PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3508 -ip 3508
1⤵
PID:1148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 836 -ip 836
1⤵
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4404 -ip 4404
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
595012d1f81b0cda42fe6e22f30ae2d5

SHA1
0b7bc01191e4025ce804fcc7b6b0876833714072

SHA256
e0a17b48c6426d792bf66871ab6d1210d8770d70c486be48341829c65e383f5b

SHA512
3e78ff559fa83f84203794239994bf461072bb4629bc09519702cb036c790e3f0cbee1f8bd6cdd1c899fac77fe75c56b5fb4cabd08d38bd39df348546a6bf78a

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
d8dc678a990a8c9c9cda88f0c85cbe7f

SHA1
0b040a20c5fe18ab9cf556c55aaeafe57caf7464

SHA256
249d43173536b014132143ab2662a6ce14272b622d62e1d120f3878c70464002

SHA512
d5c179a2c8399e6362f50390eca0473dcf6ccdc12011a37eaa05f8cdd5bd4694f39a27734e1ce6b5a34a8abb845f333f876eab96b26a333f8a5a8dfd49c2b596

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
509a911a4d4e564d61126bb5394cb4ff

SHA1
1a3db1e98ab06750600da23b45758cc53a6ba19a

SHA256
8725b90d5cc610815bc61385a4eeacb8fcb947e0421abdb9ebc62a3da5125f32

SHA512
ab992d8982c12310134a90066cfecd6b684381833cabc1da2a78d7292c1cb0d24aae3350ddc8622c191aea71e7075c05d159b3555d49b566c34cc58cfe27a0e9

Download Submit
memory/836-31-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/836-49-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1188-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1188-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1188-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1540-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1540-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1540-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1540-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2916-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2916-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3332-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3332-29-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3332-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3332-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3332-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3332-16-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3332-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3508-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3512-47-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3512-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3512-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3512-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4404-43-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download