neconyd | 22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe
Size

134KB
MD5

91c54ffb27d073dbbf36bfd919a4ee08
SHA1

0a100eca495bdc28145bc5183ed5466c8328bc33
SHA256

22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1
SHA512

6b2e6c9e13d6c79cc740af1737cf5bdb128913c0cc65b999f87f57da9ada5b3706d52298bbebe8907a6aa551f67d8c952cde05b882a620c1f873331fe0b732cf
SSDEEP

1536:7DfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:3iRTeH0iqAW6J6f1tqF6dngNmaZCia

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
4648	omsecor.exe
2512	omsecor.exe
1032	omsecor.exe
2972	omsecor.exe
1824	omsecor.exe
4472	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2396 set thread context of 4572	2396	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	83
PID 4648 set thread context of 2512	4648	omsecor.exe	87
PID 1032 set thread context of 2972	1032	omsecor.exe	108
PID 1824 set thread context of 4472	1824	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4688	4648	WerFault.exe	85
3484	2396	WerFault.exe	82
4232	1032	WerFault.exe	107
5016	1824	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 4572	2396	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	83
PID 2396 wrote to memory of 4572	2396	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	83
PID 2396 wrote to memory of 4572	2396	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	83
PID 2396 wrote to memory of 4572	2396	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	83
PID 2396 wrote to memory of 4572	2396	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	83
PID 4572 wrote to memory of 4648	4572	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	85
PID 4572 wrote to memory of 4648	4572	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	85
PID 4572 wrote to memory of 4648	4572	22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe	85
PID 4648 wrote to memory of 2512	4648	omsecor.exe	87
PID 4648 wrote to memory of 2512	4648	omsecor.exe	87
PID 4648 wrote to memory of 2512	4648	omsecor.exe	87
PID 4648 wrote to memory of 2512	4648	omsecor.exe	87
PID 4648 wrote to memory of 2512	4648	omsecor.exe	87
PID 2512 wrote to memory of 1032	2512	omsecor.exe	107
PID 2512 wrote to memory of 1032	2512	omsecor.exe	107
PID 2512 wrote to memory of 1032	2512	omsecor.exe	107
PID 1032 wrote to memory of 2972	1032	omsecor.exe	108
PID 1032 wrote to memory of 2972	1032	omsecor.exe	108
PID 1032 wrote to memory of 2972	1032	omsecor.exe	108
PID 1032 wrote to memory of 2972	1032	omsecor.exe	108
PID 1032 wrote to memory of 2972	1032	omsecor.exe	108
PID 2972 wrote to memory of 1824	2972	omsecor.exe	110
PID 2972 wrote to memory of 1824	2972	omsecor.exe	110
PID 2972 wrote to memory of 1824	2972	omsecor.exe	110
PID 1824 wrote to memory of 4472	1824	omsecor.exe	112
PID 1824 wrote to memory of 4472	1824	omsecor.exe	112
PID 1824 wrote to memory of 4472	1824	omsecor.exe	112
PID 1824 wrote to memory of 4472	1824	omsecor.exe	112
PID 1824 wrote to memory of 4472	1824	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe
"C:\Users\Admin\AppData\Local\Temp\22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe
  C:\Users\Admin\AppData\Local\Temp\22dbaffae0785ce8ad3c71bc4b45dfa82c89dabd08bac68733b46e2f5e3281d1.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1032
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 256
        8⤵
        Program crash
        
        PID:5016
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 292
        6⤵
        Program crash
        
        PID:4232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 300
      4⤵
      Program crash
      PID:4688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 288
  2⤵
  - Program crash
  PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2396 -ip 2396
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4648 -ip 4648
1⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1032 -ip 1032
1⤵
PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1824 -ip 1824
1⤵
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
f18f4b9f81fe85a082df9cdec3a89204

SHA1
5f5181c9d52cd43311394c16c526ca564ce1f2a4

SHA256
6ee76168150b9371d5644d317dc43073f9f2f283f638b1690426e6374a673707

SHA512
00e53b05e99f826d495ace7dc1039c424e69304e144bb210b54360929a7ca5b2e5ba83eee210ebd59ff22f4cdeb986fd0098920be628e4694ce45fd0375bfa08

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
1c308e7def513112b25cc9bc6bae6f58

SHA1
257bbf7545708cc9c791d17160255f8a538452bb

SHA256
74e17db4a910b2aa6da337c663de8de1e7a3c93f3a6e804b01ae1318ddddd534

SHA512
4a1fda2f250df3fc001d52ec0c68dda8e7f1bb4e9b0ec7c23baa3d1abcbfdf32d9b52c57fe75ee90e69ec8d523d2b37d05232ee52c9a9e3467d887a7d8d08540

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
3c410536c98a1b623898a09697a5a0f0

SHA1
1fba0823f86a2b131d89cdc263f3748c867ce5bb

SHA256
54aebf0f6177eac1d5a3d03191b761e0a7134240d4e2b4c91d0e00b6d8069fac

SHA512
53fe1f6ba20147fa8fce9305a40ccd77fd3e8c68e59928bc872f70c416ec078eb7a7bff6d6633219ea8c7aada1a81f8b2d5a0fca16838a7ebc9699c3095a66bf

Download Submit
memory/1032-49-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1032-31-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1824-43-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2396-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2396-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2512-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2512-28-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2512-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2512-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2512-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2512-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2512-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2972-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2972-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2972-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4472-47-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4472-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4472-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4472-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4572-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4572-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4572-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4572-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4648-7-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4648-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download