neconyd | d7ef65fd972277829b247655aeaa985738e5eb6028bc9eaf4006ae02a79b50c0

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2024, 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7ef65fd972277829b247655aeaa985738e5eb6028bc9eaf4006ae02a79b50c0.exe
Size

65KB
MD5

094d56d2da3041bb8815811ce7b5214e
SHA1

ebaf98345d06ec97eb65029233e937f8582613b2
SHA256

d7ef65fd972277829b247655aeaa985738e5eb6028bc9eaf4006ae02a79b50c0
SHA512

8e9e16948a84aec3539f3a249c27c6376c3e91fb85464417747c07eaa533b1c8e23eea2493400800d1adb15a69c8b730d9637714d1209b7bc23b6aa7f58a24ea
SSDEEP

1536:Bd9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZ/Hz:xdseIO+EZEyFjEOFqTiQmRHz

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
836	omsecor.exe
3476	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7ef65fd972277829b247655aeaa985738e5eb6028bc9eaf4006ae02a79b50c0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 836	3892	d7ef65fd972277829b247655aeaa985738e5eb6028bc9eaf4006ae02a79b50c0.exe	83
PID 3892 wrote to memory of 836	3892	d7ef65fd972277829b247655aeaa985738e5eb6028bc9eaf4006ae02a79b50c0.exe	83
PID 3892 wrote to memory of 836	3892	d7ef65fd972277829b247655aeaa985738e5eb6028bc9eaf4006ae02a79b50c0.exe	83
PID 836 wrote to memory of 3476	836	omsecor.exe	101
PID 836 wrote to memory of 3476	836	omsecor.exe	101
PID 836 wrote to memory of 3476	836	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\d7ef65fd972277829b247655aeaa985738e5eb6028bc9eaf4006ae02a79b50c0.exe
"C:\Users\Admin\AppData\Local\Temp\d7ef65fd972277829b247655aeaa985738e5eb6028bc9eaf4006ae02a79b50c0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:3476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
65KB

MD5
359a3222942fd7f53acf78503cd3595b

SHA1
9645d8586e7c5311489e28c89e31b3d26f41c5af

SHA256
1fb9d9767490839b3308779d69178300d305ea19caff320c8eabbc2a1dfafc19

SHA512
76b057054cd15a7a8b8ef1f3dd942a95a0b9a79cc0bc1b60dfbbb22334d5f2c0726b1bb55d6fadd67c74b6d65d21830d0a222d82e019023a94ea5b9aa3341432

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
65KB

MD5
cdeeaf5a210fdc6c7d74995b73764e48

SHA1
43c094b6ca7217626822c4c5264b3aed3922d315

SHA256
4e3a054b25b02e01be1192ae9beee09dc86b2bc0a6284ade1d8f100e6247264d

SHA512
6c9cc11c3fe4bbffb83d15cf404c4896661409b5d6f092cd21ec549ca04cdbd6a3eb8ea5d597a117efeec100d3217ba733e3da6a627ae0d577a3402a30b883d0

Download Submit
memory/836-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/836-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/836-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3476-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3476-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3892-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3892-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download