neconyd | de2fc8723a125bbb92de8830f03ace00cce96ecc08b1e7f395bfccb330292de0

Analysis

max time kernel
114s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2024, 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de2fc8723a125bbb92de8830f03ace00cce96ecc08b1e7f395bfccb330292de0.exe
Size

89KB
MD5

d296c36c7bb078d84046c9a87b06f5ba
SHA1

5a9c35bb908c17d7972b2623c9bba5e63e71e06a
SHA256

de2fc8723a125bbb92de8830f03ace00cce96ecc08b1e7f395bfccb330292de0
SHA512

cca65700cb211afd7e0b3eedfa346d5565afbeeab43841e003933686d5dbe4ab3fae029881816d730cd8df62253991ce2c25c80e0ab51209a37d692ba81e9901
SSDEEP

768:JMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uAX:JbIvYvZEyFKF6N4yS+AQmZTl/5P

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
4508	omsecor.exe
3236	omsecor.exe
1220	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de2fc8723a125bbb92de8830f03ace00cce96ecc08b1e7f395bfccb330292de0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 4508	3716	de2fc8723a125bbb92de8830f03ace00cce96ecc08b1e7f395bfccb330292de0.exe	82
PID 3716 wrote to memory of 4508	3716	de2fc8723a125bbb92de8830f03ace00cce96ecc08b1e7f395bfccb330292de0.exe	82
PID 3716 wrote to memory of 4508	3716	de2fc8723a125bbb92de8830f03ace00cce96ecc08b1e7f395bfccb330292de0.exe	82
PID 4508 wrote to memory of 3236	4508	omsecor.exe	92
PID 4508 wrote to memory of 3236	4508	omsecor.exe	92
PID 4508 wrote to memory of 3236	4508	omsecor.exe	92
PID 3236 wrote to memory of 1220	3236	omsecor.exe	93
PID 3236 wrote to memory of 1220	3236	omsecor.exe	93
PID 3236 wrote to memory of 1220	3236	omsecor.exe	93

C:\Users\Admin\AppData\Local\Temp\de2fc8723a125bbb92de8830f03ace00cce96ecc08b1e7f395bfccb330292de0.exe
"C:\Users\Admin\AppData\Local\Temp\de2fc8723a125bbb92de8830f03ace00cce96ecc08b1e7f395bfccb330292de0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
89KB

MD5
c30c7e2a6566aba72988633b58ab6b02

SHA1
386607b55a7496666e73562938d05ae6586cf64e

SHA256
cb703a2a88c6e8caf20cd1af50923e9cbf6ca35042d4c59c52cde00c7b47f8f7

SHA512
c23b194c21e6fbd8a6d736ac05a1a422a804ac9fcf73114e543e34105d1e43be44bee5dfab222fbe15c6e335bd90f620b1f6a9bf31a24175c237b5cb3d311258

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
89KB

MD5
f3026d31809fd4e716d6a4a0f7addc3e

SHA1
1cc3bbb70d4d2712d90bd9cc6854ec9aa682deec

SHA256
81ba2fca5075c05047021d5bd68b5b3476fe99de0378397ed94b369a1bc35058

SHA512
42a8c2e1e94f2fe78a017fb7d3316f8862c23e58c6b810f83ddba920c6b3fbcebe92418dc9d9f343182cf9c2361455721d7e0f24065e239110050e2a92da0455

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
89KB

MD5
21de479ab4a21c807381d55838fd9720

SHA1
24711b126ff0539af001a16db8115e7c91ef64ec

SHA256
11a5994495d59cb429c2c45cf9d7f2018668933164ea5b8e8047ed0b088d3c7a

SHA512
6207fefb2fecf93d07b7863a6836aa6390b53bb6cab7b989af7d925c4f0f65e3f7d2b3a69b1fc23a44653e9eb6c88940439073341046e2f529a4efeda248cb97

Download Submit