neconyd | e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a.exe
Size

72KB
MD5

079298856becc586055d399ad5a5e2f4
SHA1

e71567fa6db0a2f8ec739e304282856306ce2327
SHA256

e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a
SHA512

2e9bb64ccf48e44e69520b838c16ae8df3e5b4ca2f9555a5753412392b3b2f650132c5769c7832132839ba5e80cd10c33ebacb1107f258b2a78eb273880f9449
SSDEEP

1536:yd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:CdseIOMEZEyFjEOFqTiQm5l/5211

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 2 IoCs

pid	Process
556	omsecor.exe
3268	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 344 wrote to memory of 556	344	e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a.exe	83
PID 344 wrote to memory of 556	344	e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a.exe	83
PID 344 wrote to memory of 556	344	e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a.exe	83
PID 556 wrote to memory of 3268	556	omsecor.exe	100
PID 556 wrote to memory of 3268	556	omsecor.exe	100
PID 556 wrote to memory of 3268	556	omsecor.exe	100

C:\Users\Admin\AppData\Local\Temp\e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a.exe
"C:\Users\Admin\AppData\Local\Temp\e97a3f55c3259cd7903203982abb86e6d3dbabf4085737c7cbedc610def4402a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:344
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
72KB

MD5
35cb006f3e89671f47c1279788e7f1a3

SHA1
c6e1c611841c6effe2f08124c733b6908e64feaf

SHA256
db7db8518c27a79ae88f6e50716df62bc8d2b0384992db60b607ee4a7a723719

SHA512
99cc00f9f1e79c2076da0c48136b6e192bcfda01b75a3d0cbe67be06960490646307883c22bbe785d863ebbf822a2cda5458d06e710808958ec23ee05f0b172f

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
72KB

MD5
224deedb00c9bc5a320d8ef9a7881355

SHA1
6241bc26ac77e1ded3c2416d3091a7cd9d60e750

SHA256
10fae009888109ff19f88229d978356dc3778a1ffdc25b88b9389ce1f2b44858

SHA512
cb2b9e93a9c9aeb11f662cf1912c195dc4ee3e4c48e03cfabb88aaa086a1cb79813190c10381ad21dfb8500d4cdd1573111342bc0ca683efa9dee08f343c1e4a

Download Submit