neconyd | 623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8

Analysis

max time kernel
114s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
Size

71KB
MD5

2304f8a81adeb321a98aad88eb540694
SHA1

982834579ead861d2a40a1b8aa1dc03acd496fb0
SHA256

623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8
SHA512

13cca69b385494b10d5fd1215de1176482b1472f8c6ecb8ef3ebd130beffcc70ab7e870a55797d08de70d6966e53857b96da8659ebfa1b2ff41c0e68efdab847
SSDEEP

1536:cd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZSDHIbH/:kdseIOMEZEyFjEOFqTiQmQDHIbH/

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
1472	omsecor.exe
1012	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 1472	3832	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe	82
PID 3832 wrote to memory of 1472	3832	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe	82
PID 3832 wrote to memory of 1472	3832	623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe	82
PID 1472 wrote to memory of 1012	1472	omsecor.exe	92
PID 1472 wrote to memory of 1012	1472	omsecor.exe	92
PID 1472 wrote to memory of 1012	1472	omsecor.exe	92

C:\Users\Admin\AppData\Local\Temp\623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe
"C:\Users\Admin\AppData\Local\Temp\623e745ea1feb9ddc6bdf5fe6042364467ac7a8cc1c6f851d5f30f0714ec21f8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
71KB

MD5
7e7609f784087520d682a9eba366dab8

SHA1
f77b7b31cd9a716f0e448c006d9e51628a392c60

SHA256
77ff00f5530ee100454c15c431075d0c3794f38d6a647a7dcfefc106e2e7845a

SHA512
4f7737b1fd47cfa844acb70294a72cb3dc15de58a907165136c324e308441f1a78fb6442b7a5062e68e0b3f0d0024a5a0bf6a226758febb68f1c0a3870ad16ef

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
71KB

MD5
d747e823ef253ccef0c35a4de2f042e3

SHA1
abc96c21420ae7aea4bf1822f4f305006eca4ccf

SHA256
ebe83a7bde31801d28e6c2f5523b02184dab21aaa79c8d84950faaab3cf76cd3

SHA512
393499a6d23c2525c04755a8df93eabb44179f4ddb44df0010b6701e6074b660f96736896cc636712a8686a6b6e24033b51025dc3698e1c5a9bff5389b6319ef

Download Submit
memory/1012-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1012-14-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1472-4-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1472-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1472-13-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3832-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3832-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download