neconyd | f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051a

Analysis

max time kernel
119s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051aN.exe
Size

96KB
MD5

eb8c205941d1fc8787f4eb990ab6ff30
SHA1

b14c6682a68a62207e630b32d04ab476565f0aed
SHA256

f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051a
SHA512

f8f22ad5da59e1ab8b0c3cc6e14cac7016ea7b41b44e189bb968a4d0c8f06669b073825407a4db8006e178068391bc20a2608f8ede14f2187f5b70412ed62984
SSDEEP

1536:onAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:oGs8cd8eXlYairZYqMddH13L

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
736	omsecor.exe
1096	omsecor.exe
4376	omsecor.exe
2112	omsecor.exe
1908	omsecor.exe
4372	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 552 set thread context of 3624	552	f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051aN.exe	83
PID 736 set thread context of 1096	736	omsecor.exe	87
PID 4376 set thread context of 2112	4376	omsecor.exe	108
PID 1908 set thread context of 4372	1908	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3216	552	WerFault.exe	82
3912	736	WerFault.exe	85
340	4376	WerFault.exe	107
4444	1908	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051aN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051aN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 3624	552	f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051aN.exe	83
PID 552 wrote to memory of 3624	552	f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051aN.exe	83
PID 552 wrote to memory of 3624	552	f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051aN.exe	83
PID 552 wrote to memory of 3624	552	f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051aN.exe	83
PID 552 wrote to memory of 3624	552	f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051aN.exe	83
PID 3624 wrote to memory of 736	3624	f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051aN.exe	85
PID 3624 wrote to memory of 736	3624	f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051aN.exe	85
PID 3624 wrote to memory of 736	3624	f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051aN.exe	85
PID 736 wrote to memory of 1096	736	omsecor.exe	87
PID 736 wrote to memory of 1096	736	omsecor.exe	87
PID 736 wrote to memory of 1096	736	omsecor.exe	87
PID 736 wrote to memory of 1096	736	omsecor.exe	87
PID 736 wrote to memory of 1096	736	omsecor.exe	87
PID 1096 wrote to memory of 4376	1096	omsecor.exe	107
PID 1096 wrote to memory of 4376	1096	omsecor.exe	107
PID 1096 wrote to memory of 4376	1096	omsecor.exe	107
PID 4376 wrote to memory of 2112	4376	omsecor.exe	108
PID 4376 wrote to memory of 2112	4376	omsecor.exe	108
PID 4376 wrote to memory of 2112	4376	omsecor.exe	108
PID 4376 wrote to memory of 2112	4376	omsecor.exe	108
PID 4376 wrote to memory of 2112	4376	omsecor.exe	108
PID 2112 wrote to memory of 1908	2112	omsecor.exe	110
PID 2112 wrote to memory of 1908	2112	omsecor.exe	110
PID 2112 wrote to memory of 1908	2112	omsecor.exe	110
PID 1908 wrote to memory of 4372	1908	omsecor.exe	112
PID 1908 wrote to memory of 4372	1908	omsecor.exe	112
PID 1908 wrote to memory of 4372	1908	omsecor.exe	112
PID 1908 wrote to memory of 4372	1908	omsecor.exe	112
PID 1908 wrote to memory of 4372	1908	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051aN.exe
"C:\Users\Admin\AppData\Local\Temp\f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051aN.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051aN.exe
  C:\Users\Admin\AppData\Local\Temp\f58f93502ddab409e19510cafa303890b56b4f889728a69b28f5019fc73f051aN.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:736
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1096
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4376
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2112
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 256
        8⤵
        Program crash
        
        PID:4444
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 292
        6⤵
        Program crash
        
        PID:340
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 228
      4⤵
      Program crash
      PID:3912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 300
  2⤵
  - Program crash
  PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 552 -ip 552
1⤵
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 736 -ip 736
1⤵
PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4376 -ip 4376
1⤵
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1908 -ip 1908
1⤵
PID:3652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
8874f985a5a113bcda0d1697859fda15

SHA1
d032ae3146edfc4dfa18c5da925d628356f01784

SHA256
dfc7329a1f607ab440ddc0fffecef121fb04e7f368ed5603b3a9e708796050f6

SHA512
b2f38483c5ecf5e4ffa8266547aaa9172d3f5b1a36741224572e1459ed8b5529cd9ddd5e10d56b5ddaaf06415d9142c66d8c6328b27ec2eb48c1441a78e6080f

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
f8fc16ff72b1784161e44a7a9728a756

SHA1
3653b4b7fcbefb4fe72a91caf2d14e54d60bf8fc

SHA256
c202942c62a0da9cfc0a7e593b2cce16696d37383798fef09bf9a8d113766a7f

SHA512
595995ea10100e2af22c4f2a1a123450b27f0676470e2e617f1a616d09033ef3cdc5f145b1d63b249b4e71a34b327dbf309f85dd239d5b9a564916f289f22419

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
4d5c7a7d11f319fe343861970e51b9f0

SHA1
f17bce25d9869621abd4903243223af49b6101ee

SHA256
36e2e274d1a3bbf5e9018a83c792c142b9194950047ba07b0a03934a766f7045

SHA512
bbfdde577d0b2001855eb05461c111e632590f22b0a615746e3a49f1974618c1899f088d7c670a0151877bfe6b363428498e2305591f6244f0a94afb9d3a0b5f

Download Submit
memory/552-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/552-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/736-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/736-10-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1096-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1096-16-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1096-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1096-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1096-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1096-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1096-31-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1908-53-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1908-44-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2112-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2112-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2112-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3624-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3624-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3624-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3624-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4372-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4372-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4372-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4376-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4376-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download