neconyd | 552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919.exe
Size

76KB
MD5

1cb116e774a27cb62cb868a1a9d0539b
SHA1

a26c3440eb2f7ea83ab8bf5551c33ce3440097cf
SHA256

552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919
SHA512

38db25d06185eb26e62733d75e41ed52029648c93c2bcd59253d606dcb1df7f78e6883626797c5a149d7cac9421dfa343b5ba6e713b6311140fd7cdb9da7eeb9
SSDEEP

768:XMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAWZ:XbIvYvZEyFKF6N4yS+AQmZTl/5OZ

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2132	omsecor.exe
1676	omsecor.exe
2204	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2132	2360	552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919.exe	83
PID 2360 wrote to memory of 2132	2360	552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919.exe	83
PID 2360 wrote to memory of 2132	2360	552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919.exe	83
PID 2132 wrote to memory of 1676	2132	omsecor.exe	99
PID 2132 wrote to memory of 1676	2132	omsecor.exe	99
PID 2132 wrote to memory of 1676	2132	omsecor.exe	99
PID 1676 wrote to memory of 2204	1676	omsecor.exe	100
PID 1676 wrote to memory of 2204	1676	omsecor.exe	100
PID 1676 wrote to memory of 2204	1676	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919.exe
"C:\Users\Admin\AppData\Local\Temp\552f4da914522f692d1ec128459bc5b790aa6614f706fa1eaa10a5cdbc00d919.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
bb1031787abeae8183712eef66ea2c20

SHA1
bc7664d20b001438d9e5547a597af2f597892abe

SHA256
63a6f378ecbe8138a4769864e5ac5b3972be96c6e1451b94f057206f16c0ba82

SHA512
404d324ff76e64064b41201914b126422689c443646c2e70d637711a451b96d3ff434e6f16ebba21f273ab186238937edd4689aa3f272640729f96a7bcfcb1fa

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
76KB

MD5
085c7efa2c3cf7ef179a060bf70ec7e9

SHA1
b622fa8038a4cd07fc0f5cdbf05c1d61a5f960b1

SHA256
5db9f23cd6bd0c79dc8e6bc82e48e16f6be78c69ad8228cf125ffc07d356678b

SHA512
8d6537d37e9a22625181c1a4136f178b6458b77c677e35427a93181db67a52d020ba9454c7a9ba01728e1224f969c16af4e8b542273cc894395ae35d7b70ce00

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
76KB

MD5
e21af1e054ce3cf3d35b75c9fa24ece7

SHA1
a41ce859142047fe6a50507176e222184d576d5e

SHA256
62052a9f338780c2ee551e4e09b93fdf8fe2e734401c4b01dd79c50455e73c80

SHA512
dc6cc299b4c4d157365b31a442f69e93727f82669158c39174e02c87e86790dbac622856a9de63127e3c059801a1b5fe0b306707186e1124a9747a6a9a26de03

Download Submit