neconyd | ff1c9ae7af4c7c0b20662f8ab118caefbc35c2efb3eba769cc504c2574195335

Analysis

max time kernel
116s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff1c9ae7af4c7c0b20662f8ab118caefbc35c2efb3eba769cc504c2574195335N.exe
Size

88KB
MD5

8e1a22da248cd2516919fc1bacf92de0
SHA1

575a3ab9be9678886265cd35d24c3544eceec33f
SHA256

ff1c9ae7af4c7c0b20662f8ab118caefbc35c2efb3eba769cc504c2574195335
SHA512

74b96ac89b30e54d903610298244f29e260f839f04a55836cc550d54c178c424e4a137401b278eeb803c46216668778941e2ad6df50e1de7999bff5b49e99e1c
SSDEEP

1536:Qd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5R:QdseIOMEZEyFjEOFqTiQm5l/5R

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2668	omsecor.exe
2552	omsecor.exe
4180	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff1c9ae7af4c7c0b20662f8ab118caefbc35c2efb3eba769cc504c2574195335N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2668	1128	ff1c9ae7af4c7c0b20662f8ab118caefbc35c2efb3eba769cc504c2574195335N.exe	84
PID 1128 wrote to memory of 2668	1128	ff1c9ae7af4c7c0b20662f8ab118caefbc35c2efb3eba769cc504c2574195335N.exe	84
PID 1128 wrote to memory of 2668	1128	ff1c9ae7af4c7c0b20662f8ab118caefbc35c2efb3eba769cc504c2574195335N.exe	84
PID 2668 wrote to memory of 2552	2668	omsecor.exe	94
PID 2668 wrote to memory of 2552	2668	omsecor.exe	94
PID 2668 wrote to memory of 2552	2668	omsecor.exe	94
PID 2552 wrote to memory of 4180	2552	omsecor.exe	95
PID 2552 wrote to memory of 4180	2552	omsecor.exe	95
PID 2552 wrote to memory of 4180	2552	omsecor.exe	95

C:\Users\Admin\AppData\Local\Temp\ff1c9ae7af4c7c0b20662f8ab118caefbc35c2efb3eba769cc504c2574195335N.exe
"C:\Users\Admin\AppData\Local\Temp\ff1c9ae7af4c7c0b20662f8ab118caefbc35c2efb3eba769cc504c2574195335N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
88KB

MD5
6982da5d8f7d4a832bc62b4edd2ed0db

SHA1
415f47c8f57c7339b429fc3b497ebc3563511969

SHA256
7ff68e180c6b32e9379b781f7aa65acb8b3829ef5b2e4173e3e7db6d8cfba524

SHA512
b55f33d0b9cf1121e2517a0118385b64cdd21d133965e0b0e083b56910be2664d97cf4aaefc5603d55b0d3a1e7760dbc41e1bd0c6bb1f2ea98d721ba0f9b516d

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
88KB

MD5
f84c76ce732b1517cd14589d4accd31e

SHA1
c0d1802fa3ef3850f19444269dad2c25f60e394c

SHA256
fe90ccba616c2a0b39652cf4230e139020316abedb8a3aa6550c2c72e92fea9d

SHA512
383e416d200b1b1d29dc473e3b6e865cc250bb3d658a1aca536b6b7e2f27daefeb20c2381fd4908f195e870c29311b2128c7447fc58d33468fed3e199887fd92

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
88KB

MD5
896849b5e7e6a17822722d5a3fa5d745

SHA1
d1627c7e74caf5dff1263e40e8274d2b08db9490

SHA256
90b0ad217611510f0a14fc1aa5fc6f63c97c8e09a8ba3b30e588f7104356f99a

SHA512
5a1a5c38208a0107334e08a87d71d34de0e43fee7f7a3f79bfd4a3397e4b24beedcf3d001f98d58ae34ba31ee6080d159d5a9460d13ee69913f6d7b128792394

Download Submit