neconyd | fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-12-2024 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe
Size

134KB
MD5

32eb432058e7df3ac503e9052922d21f
SHA1

0c5b18d9fbb106ed63d776607733b22c72710712
SHA256

fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff
SHA512

5dcf17e7cb61a391d66cc046746382e87f856bfb05de1c119fb13fd8e497c5f06f6e13973d6f9b24a81a289f29fafd93d22f831d2013d585b22eec2264cb3460
SSDEEP

1536:2DfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:oiRTeH0iqAW6J6f1tqF6dngNmaZCia

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2576	omsecor.exe
2332	omsecor.exe
2956	omsecor.exe
2028	omsecor.exe
1832	omsecor.exe
1972	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
1252	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe
1252	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe
2576	omsecor.exe
2332	omsecor.exe
2332	omsecor.exe
2028	omsecor.exe
2028	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 1252	1744	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	30
PID 2576 set thread context of 2332	2576	omsecor.exe	32
PID 2956 set thread context of 2028	2956	omsecor.exe	36
PID 1832 set thread context of 1972	1832	omsecor.exe	38

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1252	1744	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	30
PID 1744 wrote to memory of 1252	1744	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	30
PID 1744 wrote to memory of 1252	1744	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	30
PID 1744 wrote to memory of 1252	1744	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	30
PID 1744 wrote to memory of 1252	1744	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	30
PID 1744 wrote to memory of 1252	1744	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	30
PID 1252 wrote to memory of 2576	1252	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	31
PID 1252 wrote to memory of 2576	1252	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	31
PID 1252 wrote to memory of 2576	1252	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	31
PID 1252 wrote to memory of 2576	1252	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	31
PID 2576 wrote to memory of 2332	2576	omsecor.exe	32
PID 2576 wrote to memory of 2332	2576	omsecor.exe	32
PID 2576 wrote to memory of 2332	2576	omsecor.exe	32
PID 2576 wrote to memory of 2332	2576	omsecor.exe	32
PID 2576 wrote to memory of 2332	2576	omsecor.exe	32
PID 2576 wrote to memory of 2332	2576	omsecor.exe	32
PID 2332 wrote to memory of 2956	2332	omsecor.exe	35
PID 2332 wrote to memory of 2956	2332	omsecor.exe	35
PID 2332 wrote to memory of 2956	2332	omsecor.exe	35
PID 2332 wrote to memory of 2956	2332	omsecor.exe	35
PID 2956 wrote to memory of 2028	2956	omsecor.exe	36
PID 2956 wrote to memory of 2028	2956	omsecor.exe	36
PID 2956 wrote to memory of 2028	2956	omsecor.exe	36
PID 2956 wrote to memory of 2028	2956	omsecor.exe	36
PID 2956 wrote to memory of 2028	2956	omsecor.exe	36
PID 2956 wrote to memory of 2028	2956	omsecor.exe	36
PID 2028 wrote to memory of 1832	2028	omsecor.exe	37
PID 2028 wrote to memory of 1832	2028	omsecor.exe	37
PID 2028 wrote to memory of 1832	2028	omsecor.exe	37
PID 2028 wrote to memory of 1832	2028	omsecor.exe	37
PID 1832 wrote to memory of 1972	1832	omsecor.exe	38
PID 1832 wrote to memory of 1972	1832	omsecor.exe	38
PID 1832 wrote to memory of 1972	1832	omsecor.exe	38
PID 1832 wrote to memory of 1972	1832	omsecor.exe	38
PID 1832 wrote to memory of 1972	1832	omsecor.exe	38
PID 1832 wrote to memory of 1972	1832	omsecor.exe	38

C:\Users\Admin\AppData\Local\Temp\fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe
"C:\Users\Admin\AppData\Local\Temp\fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe
  C:\Users\Admin\AppData\Local\Temp\fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2332
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2956
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
e17e6f6e8f6594f8c820f7094df3d4a5

SHA1
1883b26cf91bd9eaca5b08b3cd6903bd6aac1940

SHA256
d391c3a47f66fb3a5fa383411f992ff2ce12ac2782e00130ae5121c883a17311

SHA512
12f41937156f7bb82d4f673b8043f6062a8bbf91b9ffe6dfc3c2aad315313d357fbc39e2c3f0c4b0ace8557f7fafc21436eb13568b0aa37de0a83640344f3037

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
916efcc9eec510a0e5dee94e461f927f

SHA1
2c2f265a29ff5895290e276452a42bfded9d3a1d

SHA256
bee90901c663bcd8f0c77058a71dee0f866f9df0390ba0cdacf9b4e3bb161d99

SHA512
03cfc8037a3537e1d827396eeff1cac168733da210e09c51fb579f0a30f12c40b4b9e66fa9b59e75c8b0fec2878a186d4cc2ed48e54f1209e1cef8d2c8c7cd67

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
d8316dd4df8c2c29aeeca072a2583fa5

SHA1
8b31e7f341a1d90cb8dbb190fe763f7fb62d5811

SHA256
90f23ff1f12e529acfd82a08707464a6d445b260d1954f03f9eae4c869c0e241

SHA512
ac74f0044d717207a9568533d695dc199b763c31696408f633810415e71bac611be79b68a27c19806cc9ac7feacfa888b465a278575017a7b3c083d54b52d106

Download Submit
memory/1252-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1252-19-0x0000000000230000-0x0000000000254000-memory.dmp

Filesize
144KB

Download
memory/1252-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1252-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1252-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1252-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1252-20-0x0000000000230000-0x0000000000254000-memory.dmp

Filesize
144KB

Download
memory/1744-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1744-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1832-86-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1832-79-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1972-92-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1972-89-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2028-77-0x00000000001C0000-0x00000000001E4000-memory.dmp

Filesize
144KB

Download
memory/2028-88-0x00000000001C0000-0x00000000001E4000-memory.dmp

Filesize
144KB

Download
memory/2332-34-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2332-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2332-53-0x00000000005C0000-0x00000000005E4000-memory.dmp

Filesize
144KB

Download
memory/2332-47-0x00000000005C0000-0x00000000005E4000-memory.dmp

Filesize
144KB

Download
memory/2332-43-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2332-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2332-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2576-22-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2576-32-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2956-65-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2956-56-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download