neconyd | 552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919

Analysis

max time kernel
114s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919.exe
Size

76KB
MD5

1cb116e774a27cb62cb868a1a9d0539b
SHA1

a26c3440eb2f7ea83ab8bf5551c33ce3440097cf
SHA256

552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919
SHA512

38db25d06185eb26e62733d75e41ed52029648c93c2bcd59253d606dcb1df7f78e6883626797c5a149d7cac9421dfa343b5ba6e713b6311140fd7cdb9da7eeb9
SSDEEP

768:XMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAWZ:XbIvYvZEyFKF6N4yS+AQmZTl/5OZ

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
4012	omsecor.exe
4004	omsecor.exe
4808	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 4012	1952	552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919.exe	82
PID 1952 wrote to memory of 4012	1952	552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919.exe	82
PID 1952 wrote to memory of 4012	1952	552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919.exe	82
PID 4012 wrote to memory of 4004	4012	omsecor.exe	92
PID 4012 wrote to memory of 4004	4012	omsecor.exe	92
PID 4012 wrote to memory of 4004	4012	omsecor.exe	92
PID 4004 wrote to memory of 4808	4004	omsecor.exe	93
PID 4004 wrote to memory of 4808	4004	omsecor.exe	93
PID 4004 wrote to memory of 4808	4004	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919.exe
"C:\Users\Admin\AppData\Local\Temp\552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
710ec215452b6b2aebeb91e74e5e058d

SHA1
21211b3e938d31c0791dbea02507b98bea224a95

SHA256
6bcf9308217a2a0db66f8feb4a6738919666174067e06d6b2873328e6b4325af

SHA512
ffa7bd205de2a23a6d0d7997f5ca7028fb2796fb13139256488fbe31c05623d58db35c6ce24f7d52e3b74dee5d8f1fd3a194f668e542810688d4b9d9d840f9d1

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
bb1031787abeae8183712eef66ea2c20

SHA1
bc7664d20b001438d9e5547a597af2f597892abe

SHA256
63a6f378ecbe8138a4769864e5ac5b3972be96c6e1451b94f057206f16c0ba82

SHA512
404d324ff76e64064b41201914b126422689c443646c2e70d637711a451b96d3ff434e6f16ebba21f273ab186238937edd4689aa3f272640729f96a7bcfcb1fa

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
76KB

MD5
7705d11fe7d68321436170b3cd6b3066

SHA1
47fc2951abcd7c4a353f0bb044ba5b241fdf9769

SHA256
e492e321427c1c99f16b56f2a837228cfceef7fba5e1311cf76836a5ac10781d

SHA512
6710da06af7f17fa44c9a2433c390c459e055ca73b702fc5161e73c20d1ec98c06973198ac67860549bc216e9058c52c510f63f4bd86de7561e2cfafb1dea4c6

Download Submit