neconyd | 22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1

Analysis

max time kernel
145s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe
Size

134KB
MD5

91c54ffb27d073dbbf36bfd919a4ee08
SHA1

0a100eca495bdc28145bc5183ed5466c8328bc33
SHA256

22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1
SHA512

6b2e6c9e13d6c79cc740af1737cf5bdb128913c0cc65b999f87f57da9ada5b3706d52298bbebe8907a6aa551f67d8c952cde05b882a620c1f873331fe0b732cf
SSDEEP

1536:7DfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:3iRTeH0iqAW6J6f1tqF6dngNmaZCia

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2708	omsecor.exe
2760	omsecor.exe
2664	omsecor.exe
2920	omsecor.exe
1608	omsecor.exe
1260	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2484	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe
2484	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe
2708	omsecor.exe
2760	omsecor.exe
2760	omsecor.exe
2920	omsecor.exe
2920	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2088 set thread context of 2484	2088	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	30
PID 2708 set thread context of 2760	2708	omsecor.exe	32
PID 2664 set thread context of 2920	2664	omsecor.exe	36
PID 1608 set thread context of 1260	1608	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2484	2088	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	30
PID 2088 wrote to memory of 2484	2088	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	30
PID 2088 wrote to memory of 2484	2088	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	30
PID 2088 wrote to memory of 2484	2088	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	30
PID 2088 wrote to memory of 2484	2088	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	30
PID 2088 wrote to memory of 2484	2088	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	30
PID 2484 wrote to memory of 2708	2484	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	31
PID 2484 wrote to memory of 2708	2484	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	31
PID 2484 wrote to memory of 2708	2484	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	31
PID 2484 wrote to memory of 2708	2484	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	31
PID 2708 wrote to memory of 2760	2708	omsecor.exe	32
PID 2708 wrote to memory of 2760	2708	omsecor.exe	32
PID 2708 wrote to memory of 2760	2708	omsecor.exe	32
PID 2708 wrote to memory of 2760	2708	omsecor.exe	32
PID 2708 wrote to memory of 2760	2708	omsecor.exe	32
PID 2708 wrote to memory of 2760	2708	omsecor.exe	32
PID 2760 wrote to memory of 2664	2760	omsecor.exe	35
PID 2760 wrote to memory of 2664	2760	omsecor.exe	35
PID 2760 wrote to memory of 2664	2760	omsecor.exe	35
PID 2760 wrote to memory of 2664	2760	omsecor.exe	35
PID 2664 wrote to memory of 2920	2664	omsecor.exe	36
PID 2664 wrote to memory of 2920	2664	omsecor.exe	36
PID 2664 wrote to memory of 2920	2664	omsecor.exe	36
PID 2664 wrote to memory of 2920	2664	omsecor.exe	36
PID 2664 wrote to memory of 2920	2664	omsecor.exe	36
PID 2664 wrote to memory of 2920	2664	omsecor.exe	36
PID 2920 wrote to memory of 1608	2920	omsecor.exe	37
PID 2920 wrote to memory of 1608	2920	omsecor.exe	37
PID 2920 wrote to memory of 1608	2920	omsecor.exe	37
PID 2920 wrote to memory of 1608	2920	omsecor.exe	37
PID 1608 wrote to memory of 1260	1608	omsecor.exe	38
PID 1608 wrote to memory of 1260	1608	omsecor.exe	38
PID 1608 wrote to memory of 1260	1608	omsecor.exe	38
PID 1608 wrote to memory of 1260	1608	omsecor.exe	38
PID 1608 wrote to memory of 1260	1608	omsecor.exe	38
PID 1608 wrote to memory of 1260	1608	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe
"C:\Users\Admin\AppData\Local\Temp\22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe
  C:\Users\Admin\AppData\Local\Temp\22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2760
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2664
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
ef00f4a3f8857b9c8cfadfe3e7c491e9

SHA1
e7046fb93321820d14a6fed9d743407b3298983b

SHA256
047fec3c7d43a79f624f165afffab46b56c325265b7bd41bc3ed582968429aa8

SHA512
8c647caeb3ea7582c467e6102adfed6d738013fee7cf60316824ccac85e4151b8b213f2cca9b6349fc86c1edbfab7f3388e0c570e7984fa918a3c76942de1adc

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
1c308e7def513112b25cc9bc6bae6f58

SHA1
257bbf7545708cc9c791d17160255f8a538452bb

SHA256
74e17db4a910b2aa6da337c663de8de1e7a3c93f3a6e804b01ae1318ddddd534

SHA512
4a1fda2f250df3fc001d52ec0c68dda8e7f1bb4e9b0ec7c23baa3d1abcbfdf32d9b52c57fe75ee90e69ec8d523d2b37d05232ee52c9a9e3467d887a7d8d08540

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
7aca28584e5fd9f92203e7f042470818

SHA1
0440b68ce8cccc10c2e1e9d266776dcd715c8abe

SHA256
888271ff8c7283e35b14000d2c5624975ed56cb353ffb9d15b25496d985b5a42

SHA512
206289c3bead09c555857ba9cad561e5671e79622ae532dec24219f037f68d65f8a0d102998683468676a4eceace273072607b4d1115abe1b92567b8af469b7a

Download Submit
memory/1260-86-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1260-89-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1608-77-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1608-84-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2088-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2088-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-13-0x00000000001C0000-0x00000000001E4000-memory.dmp

Filesize
144KB

Download
memory/2484-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2484-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2484-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2484-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2484-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2664-64-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2664-56-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2708-21-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2708-30-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2760-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2760-51-0x00000000003B0000-0x00000000003D4000-memory.dmp

Filesize
144KB

Download
memory/2760-53-0x00000000003B0000-0x00000000003D4000-memory.dmp

Filesize
144KB

Download
memory/2760-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2760-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2760-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2760-33-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download