neconyd | b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240e

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240eN.exe
Size

96KB
MD5

3eb7248df35c054d346056f771ab83d0
SHA1

f9746f6f83101432d6b81f169597116c9e74e815
SHA256

b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240e
SHA512

1949f2bdd4d12d34f8f1a7f734abec83db0574cd88f0a82482e3a2f513f1962ca8627ce7d1ddd7fde92f5d5425faadcd4bf8b809d8f785b511ee34fc62617971
SSDEEP

1536:unAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxp:uGs8cd8eXlYairZYqMddH13p

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
4356	omsecor.exe
4400	omsecor.exe
2820	omsecor.exe
868	omsecor.exe
1364	omsecor.exe
2376	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3552 set thread context of 1596	3552	b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240eN.exe	83
PID 4356 set thread context of 4400	4356	omsecor.exe	88
PID 2820 set thread context of 868	2820	omsecor.exe	110
PID 1364 set thread context of 2376	1364	omsecor.exe	114

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2584	3552	WerFault.exe	82
3524	4356	WerFault.exe	86
3372	2820	WerFault.exe	109
2892	1364	WerFault.exe	112

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240eN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240eN.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 1596	3552	b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240eN.exe	83
PID 3552 wrote to memory of 1596	3552	b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240eN.exe	83
PID 3552 wrote to memory of 1596	3552	b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240eN.exe	83
PID 3552 wrote to memory of 1596	3552	b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240eN.exe	83
PID 3552 wrote to memory of 1596	3552	b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240eN.exe	83
PID 1596 wrote to memory of 4356	1596	b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240eN.exe	86
PID 1596 wrote to memory of 4356	1596	b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240eN.exe	86
PID 1596 wrote to memory of 4356	1596	b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240eN.exe	86
PID 4356 wrote to memory of 4400	4356	omsecor.exe	88
PID 4356 wrote to memory of 4400	4356	omsecor.exe	88
PID 4356 wrote to memory of 4400	4356	omsecor.exe	88
PID 4356 wrote to memory of 4400	4356	omsecor.exe	88
PID 4356 wrote to memory of 4400	4356	omsecor.exe	88
PID 4400 wrote to memory of 2820	4400	omsecor.exe	109
PID 4400 wrote to memory of 2820	4400	omsecor.exe	109
PID 4400 wrote to memory of 2820	4400	omsecor.exe	109
PID 2820 wrote to memory of 868	2820	omsecor.exe	110
PID 2820 wrote to memory of 868	2820	omsecor.exe	110
PID 2820 wrote to memory of 868	2820	omsecor.exe	110
PID 2820 wrote to memory of 868	2820	omsecor.exe	110
PID 2820 wrote to memory of 868	2820	omsecor.exe	110
PID 868 wrote to memory of 1364	868	omsecor.exe	112
PID 868 wrote to memory of 1364	868	omsecor.exe	112
PID 868 wrote to memory of 1364	868	omsecor.exe	112
PID 1364 wrote to memory of 2376	1364	omsecor.exe	114
PID 1364 wrote to memory of 2376	1364	omsecor.exe	114
PID 1364 wrote to memory of 2376	1364	omsecor.exe	114
PID 1364 wrote to memory of 2376	1364	omsecor.exe	114
PID 1364 wrote to memory of 2376	1364	omsecor.exe	114

C:\Users\Admin\AppData\Local\Temp\b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240eN.exe
"C:\Users\Admin\AppData\Local\Temp\b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240eN.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Users\Admin\AppData\Local\Temp\b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240eN.exe
  C:\Users\Admin\AppData\Local\Temp\b480246bd25b419fe841a5156e0851d3817239270adad281a51351a01525240eN.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4400
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2820
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:868
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1364
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 256
        8⤵
        Program crash
        
        PID:2892
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 296
        6⤵
        Program crash
        
        PID:3372
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 288
      4⤵
      Program crash
      PID:3524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 272
  2⤵
  - Program crash
  PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3552 -ip 3552
1⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4356 -ip 4356
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2820 -ip 2820
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1364 -ip 1364
1⤵
PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
a7aede2c5923e4f925f79e8eb4819434

SHA1
66c517a3bc1fc14b2867fd31ed35d9757b0579a6

SHA256
8fb4dcfb19e2ac24d9ecdc94a7618f12cee4fa2c5e9a02799b2bfc4565cbce48

SHA512
b02866cc2452ad843afbfcc7ac06cda0d9cca8ba1374209153a00aae27d9a873a1088b4b50703c7e9f22df96873c5e0e0a4c5b45366c714bfafe6c5327e57722

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
96KB

MD5
242501458c63f49b394d04108e0fa0f9

SHA1
ee3cfdd0766d5d3861322e53948cc8cb22dfad11

SHA256
02957d16d60dfd6fb23518613adde7e89f16749b0dd661b1fcf0961a4b9677b4

SHA512
c045ee08f8575a2b3498f497b7184bdb6f43f0e7178d68f21dd85ed087bd09ff93ab045e2cab204952e075cef7278c1c6ec07eb5e79c83a237078ae0f38ddd1f

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
96KB

MD5
7dc9dd5242d3af413976f47e52f2af2f

SHA1
62f21770cd0cd3bee46613b973771e5746d249ea

SHA256
c5bbc9d5c3aa2cb333d20b4a5047674003aae977c3ee8f62834cdcc58b18ff33

SHA512
ffaec4886792b7aa6992a0b563951b62f1728d7df66ec36ff71dc19d93343b267d671450a03d04cf0224f1021ee5b4849319534821f188587fd6fe53d297d2ee

Download Submit
memory/868-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/868-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/868-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1364-45-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1596-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1596-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1596-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1596-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2376-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2376-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2376-49-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2820-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2820-33-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3552-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3552-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4356-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4356-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4400-30-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4400-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4400-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4400-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4400-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4400-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4400-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download