neconyd | 623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
Size

71KB
MD5

2304f8a81adeb321a98aad88eb540694
SHA1

982834579ead861d2a40a1b8aa1dc03acd496fb0
SHA256

623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8
SHA512

13cca69b385494b10d5fd1215de1176482b1472f8c6ecb8ef3ebd130beffcc70ab7e870a55797d08de70d6966e53857b96da8659ebfa1b2ff41c0e68efdab847
SSDEEP

1536:cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH/:kdseIOMEZEyFjEOFqTiQmQDHIbH/

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
2012	omsecor.exe
4376	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 2012	512	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe	83
PID 512 wrote to memory of 2012	512	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe	83
PID 512 wrote to memory of 2012	512	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe	83
PID 2012 wrote to memory of 4376	2012	omsecor.exe	100
PID 2012 wrote to memory of 4376	2012	omsecor.exe	100
PID 2012 wrote to memory of 4376	2012	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
"C:\Users\Admin\AppData\Local\Temp\623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:512
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:4376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
71KB

MD5
7e7609f784087520d682a9eba366dab8

SHA1
f77b7b31cd9a716f0e448c006d9e51628a392c60

SHA256
77ff00f5530ee100454c15c431075d0c3794f38d6a647a7dcfefc106e2e7845a

SHA512
4f7737b1fd47cfa844acb70294a72cb3dc15de58a907165136c324e308441f1a78fb6442b7a5062e68e0b3f0d0024a5a0bf6a226758febb68f1c0a3870ad16ef

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
71KB

MD5
300278dec3851c0b9d5edebb574b7fcb

SHA1
3a08160001787e321f437748eca7e16f599e19b9

SHA256
43e3e84844b70ebfad96bf522dc4c3ca2e81665a1ee847344851fecd1eec79dc

SHA512
20e84085621e80df1a38b6e7a9ef4ea09d018067e0d08f17e8704813c332160f4d69f1dbb7feb51e9535ebe4df4e38840fc249023861a6c7ecb6f80c1b72a65a

Download Submit
memory/512-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/512-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2012-4-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2012-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2012-13-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4376-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4376-14-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download