neconyd | dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7

Analysis

max time kernel
114s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2024, 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7.exe
Size

88KB
MD5

ed6c1c56b223241e48bb38a0cdd33264
SHA1

ef87d012708914fe10109c7c1fde341c6f7070e6
SHA256

dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7
SHA512

7b53883d732ba8f3104b69c26e04429ecc0e2b5dc2de546d5443d7a17667f7a9a949b6d5449aeb896e1e23aae923e3dc14661eb4ab64bf4bc804e4bd6ba843b7
SSDEEP

1536:Md9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5h:0dseIOMEZEyFjEOFqTiQm5l/5h

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2132	omsecor.exe
3040	omsecor.exe
1688	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 2132	1544	dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7.exe	83
PID 1544 wrote to memory of 2132	1544	dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7.exe	83
PID 1544 wrote to memory of 2132	1544	dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7.exe	83
PID 2132 wrote to memory of 3040	2132	omsecor.exe	101
PID 2132 wrote to memory of 3040	2132	omsecor.exe	101
PID 2132 wrote to memory of 3040	2132	omsecor.exe	101
PID 3040 wrote to memory of 1688	3040	omsecor.exe	102
PID 3040 wrote to memory of 1688	3040	omsecor.exe	102
PID 3040 wrote to memory of 1688	3040	omsecor.exe	102

C:\Users\Admin\AppData\Local\Temp\dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7.exe
"C:\Users\Admin\AppData\Local\Temp\dc946334d8af3aa89d01e7a10d4856adaabc34b2c967dbf9f1a1292166f890f7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
88KB

MD5
50ec327295e0ca5e9185df02edf032ea

SHA1
d560d4db8e1bf3c7d2ba68c6d3feb5f7ff7fc79c

SHA256
6884862f989ac993cb13e00bb6b020fffc45a0b88cbda536ad5d8f178caddc7e

SHA512
5e0bf0a33142f8d6a316b425202e442c73793372c5ca36d34abc9ce5f84d0a254442e2e43faf22a2fadd3a77feea33d33e5efaaa7f96bba8d4d4878aa7527db4

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
88KB

MD5
33ccc4b44086f2433d345ec98ec8b316

SHA1
61f6c892b573419534e1f50c77523bda404a1c11

SHA256
c96cb145446f4380e5baba680bab98ab8a190d4b7ccbc63b830912a4a1c5f7ed

SHA512
97745afc789bfa165be0825b62fabf69cd1f00ffa02f427e9622aa28a080bd9e8379b931897560127b758d39fea873d5ddcf4308982680ca5152a1dd350c8016

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
88KB

MD5
7c8949f7361a8d8fc0d95e042cb65686

SHA1
5b38263ef795f7ee73116e479c96bd1bd3c6b41a

SHA256
72446fc14ea02e074023f6ad6805dc0f7e030cbc7da9206ee41dabce6416e4b6

SHA512
75a1f24b3c592946e37866e7629944b212dbef702c3905f1fdaf2da86296ae2b956d3f84534cce6412b5a42dd4e03fb24b4b2a5bd6540c3176f078d517d8a271

Download Submit