neconyd | c1ed09c4504f234b83540c8002c5676bcd12a4723c2307a88328ff803086de6d

Analysis

max time kernel
114s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1ed09c4504f234b83540c8002c5676bcd12a4723c2307a88328ff803086de6dN.exe
Size

88KB
MD5

48891af185479fc1f82a2a9f397a9760
SHA1

ee0a085015948917b5aa163dafe85062d236335d
SHA256

c1ed09c4504f234b83540c8002c5676bcd12a4723c2307a88328ff803086de6d
SHA512

8e1b450a46d8333287f577840d0bc10317f82fe6bfe0875df0f76c3390615ce95eaa486ad21d83eb5847d09671971991100f5c17e84f4ba4641429dfaeba64c4
SSDEEP

1536:Md9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5R:0dseIOMEZEyFjEOFqTiQm5l/5R

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
2288	omsecor.exe
4216	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1ed09c4504f234b83540c8002c5676bcd12a4723c2307a88328ff803086de6dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2288	1580	c1ed09c4504f234b83540c8002c5676bcd12a4723c2307a88328ff803086de6dN.exe	83
PID 1580 wrote to memory of 2288	1580	c1ed09c4504f234b83540c8002c5676bcd12a4723c2307a88328ff803086de6dN.exe	83
PID 1580 wrote to memory of 2288	1580	c1ed09c4504f234b83540c8002c5676bcd12a4723c2307a88328ff803086de6dN.exe	83
PID 2288 wrote to memory of 4216	2288	omsecor.exe	101
PID 2288 wrote to memory of 4216	2288	omsecor.exe	101
PID 2288 wrote to memory of 4216	2288	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\c1ed09c4504f234b83540c8002c5676bcd12a4723c2307a88328ff803086de6dN.exe
"C:\Users\Admin\AppData\Local\Temp\c1ed09c4504f234b83540c8002c5676bcd12a4723c2307a88328ff803086de6dN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:4216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
88KB

MD5
56ed59945ad94393aac5a6e4a9883b3e

SHA1
03bc91ce3dfbe770ad812b6e88a1046d65003654

SHA256
34d0284078626c17f5a7bb32cb0e5d570071c3096c230bd58f6f8172f62735d0

SHA512
ce489d5a648053f95fd97aca47c5ade10e2d44a28255b129989ad89beb069b3dce56b2d2d7717803a6bd24e4dba5f6477da8feea8520c595457a7934c7f9c955

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
88KB

MD5
ebc26cf8b2ec02a1cbacf1f0e50194f3

SHA1
b76ed5157e56babcfeaaab02aa76fb5f93b72a00

SHA256
396dda6b4e2b246c7f673914051af0c43889b9ba4762d04baff90780b3f12d2c

SHA512
ab6935bbf819879bdb3d56e988c91ce7d63df62c26b211c907924258c4e4309868458e634ea57f8aa9cb18efbb08a5fbc12c98764f37d3cd776b99c94a987097

Download Submit