neconyd | fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff

Analysis

max time kernel
147s
max time network
151s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-12-2024 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe
Size

134KB
MD5

32eb432058e7df3ac503e9052922d21f
SHA1

0c5b18d9fbb106ed63d776607733b22c72710712
SHA256

fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff
SHA512

5dcf17e7cb61a391d66cc046746382e87f856bfb05de1c119fb13fd8e497c5f06f6e13973d6f9b24a81a289f29fafd93d22f831d2013d585b22eec2264cb3460
SSDEEP

1536:2DfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:oiRTeH0iqAW6J6f1tqF6dngNmaZCia

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
2608	omsecor.exe
2236	omsecor.exe
592	omsecor.exe
2492	omsecor.exe
1100	omsecor.exe
1692	omsecor.exe

Loads dropped DLL 7 IoCs

pid	Process
2348	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe
2348	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe
2608	omsecor.exe
2236	omsecor.exe
2236	omsecor.exe
2492	omsecor.exe
2492	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2328 set thread context of 2348	2328	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	30
PID 2608 set thread context of 2236	2608	omsecor.exe	32
PID 592 set thread context of 2492	592	omsecor.exe	35
PID 1100 set thread context of 1692	1100	omsecor.exe	37

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2348	2328	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	30
PID 2328 wrote to memory of 2348	2328	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	30
PID 2328 wrote to memory of 2348	2328	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	30
PID 2328 wrote to memory of 2348	2328	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	30
PID 2328 wrote to memory of 2348	2328	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	30
PID 2328 wrote to memory of 2348	2328	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	30
PID 2348 wrote to memory of 2608	2348	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	31
PID 2348 wrote to memory of 2608	2348	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	31
PID 2348 wrote to memory of 2608	2348	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	31
PID 2348 wrote to memory of 2608	2348	fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe	31
PID 2608 wrote to memory of 2236	2608	omsecor.exe	32
PID 2608 wrote to memory of 2236	2608	omsecor.exe	32
PID 2608 wrote to memory of 2236	2608	omsecor.exe	32
PID 2608 wrote to memory of 2236	2608	omsecor.exe	32
PID 2608 wrote to memory of 2236	2608	omsecor.exe	32
PID 2608 wrote to memory of 2236	2608	omsecor.exe	32
PID 2236 wrote to memory of 592	2236	omsecor.exe	34
PID 2236 wrote to memory of 592	2236	omsecor.exe	34
PID 2236 wrote to memory of 592	2236	omsecor.exe	34
PID 2236 wrote to memory of 592	2236	omsecor.exe	34
PID 592 wrote to memory of 2492	592	omsecor.exe	35
PID 592 wrote to memory of 2492	592	omsecor.exe	35
PID 592 wrote to memory of 2492	592	omsecor.exe	35
PID 592 wrote to memory of 2492	592	omsecor.exe	35
PID 592 wrote to memory of 2492	592	omsecor.exe	35
PID 592 wrote to memory of 2492	592	omsecor.exe	35
PID 2492 wrote to memory of 1100	2492	omsecor.exe	36
PID 2492 wrote to memory of 1100	2492	omsecor.exe	36
PID 2492 wrote to memory of 1100	2492	omsecor.exe	36
PID 2492 wrote to memory of 1100	2492	omsecor.exe	36
PID 1100 wrote to memory of 1692	1100	omsecor.exe	37
PID 1100 wrote to memory of 1692	1100	omsecor.exe	37
PID 1100 wrote to memory of 1692	1100	omsecor.exe	37
PID 1100 wrote to memory of 1692	1100	omsecor.exe	37
PID 1100 wrote to memory of 1692	1100	omsecor.exe	37
PID 1100 wrote to memory of 1692	1100	omsecor.exe	37

C:\Users\Admin\AppData\Local\Temp\fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe
"C:\Users\Admin\AppData\Local\Temp\fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Local\Temp\fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe
  C:\Users\Admin\AppData\Local\Temp\fef6b6ece0e7b67fbc701dec5fec7989196a5146a8d139d1afd584ea5c5583ff.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2236
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:592
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2492
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
e17e6f6e8f6594f8c820f7094df3d4a5

SHA1
1883b26cf91bd9eaca5b08b3cd6903bd6aac1940

SHA256
d391c3a47f66fb3a5fa383411f992ff2ce12ac2782e00130ae5121c883a17311

SHA512
12f41937156f7bb82d4f673b8043f6062a8bbf91b9ffe6dfc3c2aad315313d357fbc39e2c3f0c4b0ace8557f7fafc21436eb13568b0aa37de0a83640344f3037

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
70cf6a3dc1a741af767e1718d05c1c49

SHA1
8a02c3542aaeaa2c3da2535ae08fde69138d0b00

SHA256
94c566d3b61b0267025fefa15a0b2eb72994b9fe85b188d88b7f73ec75e8cbd5

SHA512
2df6e3d0fbdf09d524314154819c43595b95e0158321a96220c47fd6630b3f29f5dc92ab4e127453eabbddb3f951914529359d22aa05604961d6bf1e1eb3053e

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
9e558cc71c88ed8dba2a3b49c525bd83

SHA1
d46ebe54d359e41d4aa82dd345521a7aa2abae6c

SHA256
55fbacfc0061440677c08459f8fae457473a041b5bb407555e6c05bd8550da39

SHA512
64d11ded94543ff93f31da80f8bb82119096e5525e7f5f81fe62aed2ba32edf6e8ef4c73eed11fbeb312c3de41c144cddc4331dfb3cb4a3360d3705ed65d6387

Download Submit
memory/592-63-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1100-83-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1692-88-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1692-85-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2236-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2236-45-0x00000000027A0000-0x00000000027C4000-memory.dmp

Filesize
144KB

Download
memory/2236-53-0x00000000027A0000-0x00000000027C4000-memory.dmp

Filesize
144KB

Download
memory/2236-32-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2236-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2236-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2236-42-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2328-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2328-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2348-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2348-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2348-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2348-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2348-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2492-69-0x0000000000230000-0x0000000000254000-memory.dmp

Filesize
144KB

Download
memory/2608-28-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2608-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download